This critical vulnerability in MikroTik RouterOS is being actively exploited in the wild and enables unauthenticated remote code execution.

The SSH service fails to properly enforce authentication workflows during client-requested rekeying, allowing unauthenticated remote attackers to open session channels and execute arbitrary commands. This permits the unauthorized creation, overwrite, and reconstruction of system files, including configuration and diagnostic data.

The exploitation of this flaw grants an attacker full administrative control over the affected network device. This severity is underscored by a CVSS score of 9.5, reflecting the high potential for total system compromise, unauthorized data access, and the ability to use the device as a persistent foothold for further lateral movement within the corporate network.

Immediate Action: Update RouterOS to the patched versions immediately: 7.24.2, 7.23.4, or 6.49.21.

Proactive Monitoring: Review system logs for unauthorized user creation, specifically checking for a user named "ops", and verify the "Flagged" status in the device configuration via the command /system/device-mode/print.

Compensating Controls: Restrict access to the SSH service to trusted management IP addresses only and disable remote SSH access from the public internet until the patch is applied.

Public Exploit Available: Yes, a technical write-up containing the attack methodology and reproduction steps is available via the referenced CERT Polska and Nick Pratley research documentation.

Given the confirmed active exploitation and the critical nature of the vulnerability, organizations must treat this as a high-priority incident. Apply the vendor-provided firmware updates immediately to all exposed devices. Following the update, perform a thorough audit of system configurations to identify and remove any unauthorized accounts, scripts, or scheduled tasks created during the period of compromise.