MikroTik's new RouterOS builds check whether the device was already compromised
MikroTik published RouterOS fixes in four branches with no CVE and no technical detail. The same upgrade runs a compromise check and writes a critical log entry marking the device Flagged.
The Watch · Security desk
What happened
- MikroTik says it found a security vulnerability in RouterOS and shipped the fix in 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21 and newer, across all release channels.
- The vendor is holding back the technical detail, saying it is not currently publishing it in order to give operators time to update their systems.
- MikroTik tells every operator to inspect the device for unknown scripts, users or unrecognised configuration after upgrading, whether or not the router came back Flagged.
Why it matters
- What's now possible capability Each upgraded router now reports on its own history, so an operator with no central logging can still find out whether the device was taken before the patch landed.
- What it limits constraint With no CVE and no mechanism, defenders cannot write detection for the exploit attempt or test their own configuration against it; patching and manual config review are the whole toolkit.
- Who has to decide decision A Flagged entry converts a maintenance window into an incident, and the operator has to choose between auditing the running configuration line by line and rebuilding the router.
- Who's exposed exposure MikroTik's assurance that most configurations are not at risk lets no one rule themselves out, because the at-risk configurations are unnamed.
Next story · Security · 7h ago
F5 patches three CVSS 9.2 NGINX flaws that only certain configurations exposeConfirmed2 publishers
The Flagged status is the part of this advisory worth reading twice. MikroTik wrote that RouterOS "will check if your device has been compromised" [6], and that a compromised device gets a critical entry in the Log section pointing to the Flagged status documentation [5]. Writing that check requires knowing what a compromised device looks like in configuration or on disk.
MikroTik published the fixed version numbers, the compromise check and the instruction to inspect configuration [3][5][10]. It did not publish a CVE identifier, the mechanism, the list of affected configurations, or any statement that the flaw has been used against a customer [12]. On the withholding, MikroTik wrote: "To give time to update your systems, we are not currently publishing detailed information" [2].
The fix is in 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21 and newer [3]. Three of those four branches sit in the 7.x line and the fourth is in the RouterOS 6 line, so the vulnerable code is present in both major versions [11].
The upgrade closes the hole and leaves attacker-added configuration in place. MikroTik says Flagged status does not delete configuration [8], and tells operators to inspect the device for unknown scripts, users or other config they do not recognise whether it is Flagged or not [10]. The build is offered on the device itself, through the "Check for updates" menu [13].
MikroTik says regular home users and default configurations face no immediate risk, and still suggests every user upgrade [9]. Its post also says "Most configurations are not at risk, but upgrading is highly recommended" [4], without naming the configurations that are. MikroTik says the announcement will be updated with more information in due time [7].
What to watch
- A CVE identifier and an affected-configuration list from MikroTik would tell operators whether they were ever reachable.
- Any count of Flagged devices, from operators or from internet scanning projects, would size the intrusion set.
- Whether the fix reaches further 6.x builds or a 7.25 stable release beyond the beta named in the advisory.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence76
- Adoption
- Not scored
- Hype gap−40
- Incentives45
- Confidence72
Perspective Coverage
3 publishers- Builder
- Builder 22%
- Operator
- Operator 71%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
MikroTik says it has found a security vulnerability in RouterOS and that releases containing a fix have been published in all channels.
- [2]
MikroTik wrote: "To give time to update your systems, we are not currently publishing detailed information."
- [3]
MikroTik says the fix is included in 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21, and newer.
- [4]
MikroTik wrote: "Most configurations are not at risk, but upgrading is highly recommended."
- [5]
MikroTik says RouterOS will check whether the device has been compromised and set it to "Flagged" status if it is, that this is written in the "Log" section, and that a critical log entry saying the device has been Flagged should be followed up using the instructions on the Flagged status documentation page.
- [6]
MikroTik wrote that RouterOS "will check if your device has been compromised".
- [7]
MikroTik says the announcement article will be updated with more information in due time.
- [8]
MikroTik says Flagged status does not delete configuration and that the operator should still inspect it.
- [9]
MikroTik says that for regular home device users and default configurations the issue does not pose an immediate risk, but it still suggests all users upgrade.
- [10]
MikroTik says that even if a device is not in Flagged state, after upgrading RouterOS the operator should inspect the device configuration for any unknown scripts, users or other config they do not recognise, and that this is suggested in any case.
- [11]
Of the four fixed branches MikroTik lists, three (7.25 beta 3, 7.24.2, 7.23.4) are in the RouterOS 7 line and one (6.49.21) is in the RouterOS 6 line, so the fix was applied to both major versions.
- [12]
The MikroTik announcement contains no CVE identifier, no description of the vulnerability mechanism, no list of the configurations that are at risk, and no statement that the flaw has been exploited against a customer.
- [13]
MikroTik says the device should already offer the option to upgrade software in the "Check for updates" menu.
Sources
3 independent publishers whose own reporting we read for this story.
- Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended | CERT Polska
cert.pl
2 articles · September 11, 2026
- Important security update - Announcements - MikroTik community forum
forum.mikrotik.com
1 article · September 11, 2026
- helpnetsecurity.comHackers exploit RouterOS flaws to hijack MikroTik devices without authentication
1 article · September 11, 2026