Types of Attacks Against MikroTik Devices
MikroTik routers are powerful and widely deployed, which also makes them attractive targets for attackers. Understanding what attacks are used against MikroTik devices is the first step toward defending them.
1. Brute Force Attacks
Attackers use automated tools to try thousands of username/password combinations against:
- Winbox (port 8291)
- SSH (port 22)
- Telnet (port 23)
- HTTP/HTTPS WebFig (ports 80/443)
If the default admin account has no password (factory default), the device is compromised instantly.
2. Exploitation of Known Vulnerabilities
Several critical CVEs have been discovered in RouterOS:
| CVE | Year | Type | Impact |
|---|---|---|---|
| CVE-2018-14847 | 2018 | Winbox auth bypass | Read credentials from memory |
| CVE-2019-3977 | 2019 | Downgrade attack | Force old vulnerable RouterOS |
| CVE-2019-3978 | 2019 | DNS cache poisoning | Man-in-the-middle |
| CVE-2023-30799 | 2023 | Privilege escalation | Root on RouterOS |
3. Credential Theft via Winbox Exploit
The Chimay Blue exploit (CVE-2018-14847) allowed unauthenticated attackers to read the user database file from RouterOS, exposing all usernames and passwords in plaintext. Devices running RouterOS < 6.42.1 are vulnerable.
4. Man-in-the-Middle (MITM) Attacks
Attackers on the same network segment can:
- ARP-spoof to intercept traffic
- Capture Winbox sessions (older Winbox used no encryption)
- Inject routes via BGP if the router peers with untrusted neighbors
5. Botnet Recruitment (Mēris Botnet)
In 2021 MikroTik routers were weaponized into the Mēris botnet, which conducted record-breaking DDoS attacks. Attackers exploited unpatched routers (CVE-2018-14847) and installed SOCKS proxies to route attack traffic.
6. Port Scanning and Service Fingerprinting
Attackers use tools like Shodan, nmap, and masscan to find MikroTik devices exposed on the internet. Once identified, they probe for:
- Open Winbox port
- Default credentials
- Outdated RouterOS banners
# What attackers run against your router (for awareness):
nmap -sV -p 22,23,80,443,8291 <target-ip>7. DNS Hijacking
Compromised MikroTik routers have been used to change DNS settings, redirecting users to malicious sites. This was observed in the VPNFilter malware campaign.
8. DDoS Amplification
MikroTik devices with open DNS resolvers or NTP services can be abused for amplification attacks — the attacker sends small spoofed packets and the router sends large replies to the victim.
Mitigation Summary
- Patch RouterOS to the latest stable version.
- Change default credentials immediately.
- Disable unused services (Telnet, FTP, API if not needed).
- Restrict management access to trusted IPs only.
- Use strong firewall rules to block management ports from WAN.
The following posts in this series go deep on each mitigation technique.