An argument-handling vulnerability in Mikrotik RouterOS allows unauthenticated attackers to escalate privileges to full administrator level, and this vulnerability is currently being actively exploited in the wild.

This is an argument injection vulnerability (CWE-88) occurring within the SSH login helper process. An attacker can supply a username beginning with a prohibited character to manipulate the internal policy mask, effectively granting themselves administrative privileges without valid authentication.

The vulnerability carries a critical CVSS score of 9.2, reflecting the ease of exploitation and the total loss of confidentiality, integrity, and availability. Successful exploitation grants an attacker complete administrative control over the network device. This allows for unauthorized configuration changes, traffic interception, the deployment of backdoors, and the potential for pivoting deeper into the internal network, which poses a severe threat to enterprise security and business continuity.

Immediate Action: Update RouterOS to the patched versions: 6.49.21, 7.23.4, or 7.24.2 immediately. After updating, perform a thorough inspection of the device configuration to identify and remove unauthorized users, scripts, or scheduled tasks.

Proactive Monitoring: Review system logs for suspicious login failures or entries indicating unauthorized user creation, such as the addition of an "ops" user. Check the output of the "/system/device-mode/print" command for the "Flagged" marker, which may indicate a prior compromise.

Compensating Controls: Restrict SSH access to the management interface to trusted IP addresses only using firewall filtering rules. If possible, disable SSH access entirely until the device has been successfully patched and verified.

Public Exploit Available: Yes, a technical analysis and reproduction of the flaw are documented in the researcher write-up from npratley.net.

Given the confirmed active exploitation and the critical severity of this vulnerability, immediate patching is mandatory for all internet-facing Mikrotik devices. Administrators must prioritize these updates and perform a manual audit of their device configurations to ensure no persistent backdoors remain from potential prior unauthorized access.