A critical authentication bypass vulnerability in MikroTik RouterOS is currently being actively exploited in the wild, posing a severe risk of full device compromise.

This is a cryptographic signature verification flaw (CWE-347) where the system fails to validate the RSA public key exponent. An unauthenticated attacker can supply a forged key with an exponent of one to bypass SSH authentication and gain the privileges of the targeted user.

Successful exploitation grants an attacker full control over the affected network device. This allows for unauthorized configuration changes, data exfiltration, and the establishment of persistent backdoors, such as rogue user accounts or scripts. Given the CVSS score of 9.2, this vulnerability represents a critical threat to organizational network integrity and operational continuity.

Immediate Action: Update all affected MikroTik devices to version 6.49.21, 7.23.4, 7.24.2, or the latest available patched version immediately.

Proactive Monitoring: Review system logs for unauthorized user additions, specifically looking for the "ops" account, and check the status of the "Flagged" marker using the /system/device-mode/print command to identify potential prior compromises.

Compensating Controls: Restrict SSH access to authorized management IP addresses via firewall rules and disable SSH access on public-facing interfaces until patching is complete.

Public Exploit Available: Yes — a technical write-up detailing the vulnerability mechanism is available via the CERT Polska and npratley.net research disclosures.

The severity of this vulnerability, combined with confirmed active exploitation, necessitates an immediate emergency patching cycle. Administrators must prioritize updating all MikroTik devices and subsequently performing a thorough forensic audit of the device configuration to ensure that no unauthorized changes or persistent backdoors were installed by attackers prior to the update.