The Main Radio Frequency Center, under Roskomnadzor, issued a recommendation to telecom operators to inspect MikroTik routers within their networks. Operators began receiving these notifications on September 11. The regulator advises providers to warn customers about potential security breaches and to implement protective measures.
The alert follows the discovery of six vulnerabilities in RouterOS by the CERT Polska team. These flaws affect the SSH server and client, the bandwidth-test service, X.509 certificate handling, and the WebFig interface. A combination of two vulnerabilities, dubbed MikroTrick, allows attackers to gain full control over a device without authentication if remote SSH access is enabled.
MikroTik released security updates on September 3, including versions 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21. The manufacturer advises administrators to update devices immediately and scan configurations for unauthorized users, suspicious scripts, scheduled tasks, proxies, or tunnels. CERT Polska confirms that attackers are actively exploiting these vulnerabilities on devices exposed to the internet.
Market participants note that while updating customer hardware is not a standard obligation for telecom operators, they remain responsible for network security. Providers may choose to mitigate risks by blocking specific router ports to restrict dangerous traffic without disconnecting users from the network.
