Exposed Router Management: 8.09 Million RouterOS Assets and the 9,560 That Still Answer on SSH
Exposed Router Management: 8.09 Million RouterOS Assets and the 9,560 That Still Answer on SSH The MikroTrick exploitation chain required one precondition to work at scale: a router whose SSH service was reachable from the internet. Measuring how many RouterOS devices meet that condition turns a vendor advisory into a concrete exposure estimate. The vulnerability context CERT Polska disclosed six…
MikroTrick attackers exploited two vulnerabilities in MikroTik RouterOS to gain full administrative control over devices with internet-exposed SSH services. The vulnerabilities allowed unauthenticated attackers to access devices whose SSH service was reachable from the internet. A recent measurement found that there are 8,085,997 indexed RouterOS devices worldwide, but only 9,560 of these devices expose SSH for internet access.
This suggests that the vast majority of RouterOS devices do not expose SSH to the internet or are not correctly fingerprinted. The 9,560 devices represent a minimum number of internet-visible RouterOS assets that could be targeted by attackers using the identified exploits. While an indexed asset is not necessarily vulnerable, an internet-reachable SSH service is a prerequisite for the reported attack chain.
Therefore, the 9,560 figure provides a concrete estimate of the potential attack surface for these specific vulnerabilities. Organizations with RouterOS devices should prioritize identifying and securing SSH access to protect against exploitation.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
