Critical MikroTik RouterOS Flaw (CVE-2023-30799) Lets Attackers Gain Admin Access

Key Takeaways

• A critical vulnerability, dubbed “MikroTrick,” allows unauthenticated attackers to gain full administrative control over MikroTik RouterOS devices running version 7.x.
• The attack chain leverages two distinct flaws (CVE-2023-30799 and CVE-2023-30800) in the RouterOS SSH login process.
• Evidence suggests these vulnerabilities were actively exploited before public disclosure, with researchers finding indicators of compromise on internet-facing devices.
• While patches are available, simply updating is insufficient; administrators must actively search for and remove any lingering attacker persistence mechanisms.

MikroTrick Attack Grants Full Admin Control Over MikroTik Routers

Owners of MikroTik routers are confronting a significant security risk following the successful reproduction of an attack chain, dubbed “MikroTrick,” that grants unauthorized individuals complete administrative control without needing a password. This sophisticated attack targets exposed RouterOS devices via SSH, enabling a threat actor to transform a crucial network gateway into a persistent foothold within an organization’s infrastructure.

The implications of such a compromise are severe. A router, serving as the primary conduit for all inbound and outbound network traffic, becomes a critical point of control. An attacker with administrative privileges can alter network configurations, establish clandestine accounts, intercept sensitive data, or pivot to internal systems located behind the compromised device. Troublingly, evidence uncovered by security researchers indicates that exploitation of these flaws commenced even before their public revelation.

Bishop Fox, a prominent cybersecurity firm, identified and meticulously documented this attack chain. Their investigation revealed configuration artifacts on internet-facing devices that were consistent with real-world compromises. In a detailed report shared with Cyber Security News (CSN), Bishop Fox confirmed that their testing successfully achieved full system takeover on vulnerable RouterOS 7.x builds.

This disclosure arrives amidst ongoing reports of active exploitation targeting MikroTik RouterOS. The new findings underscore a critical warning: while applying the latest updates will prevent new attacks, it does not dislodge an attacker who has already established a persistent presence on the router.

The Two-Stage MikroTrick Vulnerability Chain

The MikroTrick attack is a composite exploit, combining two distinct weaknesses, CVE-2023-30799 and CVE-2023-30800, which manifest at different stages of the RouterOS SSH login procedure. Crucially, neither vulnerability requires a valid password for successful exploitation during testing, highlighting the critical exposure posed by internet-accessible SSH services.

The initial vulnerability, CVE-2023-30799, surfaces during the SSH rekeying process, a standard operation designed to refresh encryption keys within an active connection. In affected RouterOS builds, an unauthenticated client can illicitly leverage this rekeying mechanism to access functions that should only be available after successful authentication. This allows the attacker to open a session channel and request command execution, despite lacking a legitimate identity.

The second vulnerability, CVE-2023-30800, then escalates this limited foothold to full administrative control. RouterOS transmits the SSH-supplied username to an internal helper component responsible for assigning identity and permissions. Researchers discovered that providing a username prefixed with a dash (`-`) can manipulate this helper into reading a trusted identity record from an internal communication channel, rather than processing it as a standard username.

On vulnerable RouterOS 7.x versions, Bishop Fox researchers demonstrated that an attacker-controlled terminal can inject this trusted identity record. By supplying an administrator identity and associated permissions, the attacker can bypass normal authentication protocols, forcing the device to accept their privileged session. This represents a far more severe threat than a simple authentication bypass, emphasizing the urgent need for attention to unauthenticated router access risks.

It is important to note that the first-stage bypass (CVE-2023-30799) also impacts RouterOS 6.x versions. However, Bishop Fox did not achieve a full administrative session on 6.x using the exact same method. The complete takeover chain discussed primarily applies to vulnerable RouterOS 7.x builds. This distinction is relevant for remediation strategies, but it should not deter administrators from patching any exposed device.

What You Should Do

• Immediately Patch All Devices: Update your MikroTik RouterOS devices to versions 6.49.21, 7.23.4, 7.24.2, or later. These updates prevent unauthorized sessions from accessing protected requests and block malicious username inputs.
• Assume Compromise for Exposed Routers: Treat any router that was previously exposed to the internet and running vulnerable versions as potentially compromised.
• Conduct a Thorough Post-Patch Audit: Patching alone is insufficient. Perform a comprehensive review of your router’s configuration to identify and remove any persistence mechanisms left by attackers. This includes:
  • Reviewing privileged user accounts for any unauthorized additions.
  • Analyzing configuration history for suspicious changes.
  • Checking remote logs for unusual activity (note: logs may be volatile, so collect quickly).
  • Examining scripts and scheduled tasks for malicious entries. Researchers observed a script named logrotate and a scheduled task named daily-maint configured to recreate a privileged account daily, often with an unusual owner="0" numeric ownership artifact.
  • Inspecting proxy and tunnel configurations for unauthorized routing.
  • Checking the RouterOS “flagged” state for any anomalies.
• Rotate All Credentials: Change every password, API key, and other secret stored on or observable by the router.
• Restrict SSH Access: Limit SSH access to your MikroTik routers exclusively to trusted administration networks. Disable SSH on public-facing interfaces if not absolutely necessary.
• Rebuild from a Verified Baseline: If compromise is suspected or confirmed, collect configuration and logs for forensic analysis, then rebuild the router from a known good, verified baseline configuration.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.