Mikrotik RouterOS Zero-Days Actively Exploited

Affected Environment
Mikrotik RouterOS versions 6.0.0 before 6.49.21, 7.0.0 before 7.23.4, and 7.24 before 7.24.2.

Threat Overview
Three actively exploited flaws stem from improper RSA key validation, SSH login argument handling, and btest authentication bypass.

Exposure Timeline
Actively exploited in the wild as of publication; fixed versions released across all three RouterOS branches now.

Attack Surface
SSH authentication service and btest connection handling, both reachable by unauthenticated remote network attackers.

Technical Root Cause
Incomplete RSA key comparison, a prohibited character argument flaw, and premature acceptance of related btest connections.

Exploitation Pathway
Attacker forges an SSH signature or manipulates btest connections to gain command access, escalate privileges, or crash devices.