Hi! Our Security Team send me following and can't find the info which versions should fix it. Published: Jul 28, 2026, 9:31:33 PM Updated: Jul 28, 2026, 9:31:33 PM CVSS Base Score: 8.7 (v4.0) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N MikroTik RouterOS contains a weaknes…

[image] infabo: brute force attack If you don't use easily guessable passwords (dictionary attack) then with only 8 alpha-num character long passwords, on average 100 trillion attempts are needed. If MikroTik adds only a 10ms delay, and force serialization of the authentication attempts, then…

[image] robertpenz: or source-based restrictions Fake... The real problem is: How did anyone manage to log in via API or whatever? It's like asking door manufacturers to make like an unbreakable lock, and then the door is on a public road, without even a guard. Your team is ridiculous. …

The CVE states that the delay is per session and does not work if you make more sessions.

If something is written in the CVE that's false, everything else is automatically false. Since it's more than obvious that it's possible to determine with absolute precision the IP(s) who accesses the API and everything else, the entire CVE is a load of bullshit. Like all things, if it is configu…

Mikrotik shouldn't fix all your wrong decisions in life. No sane person keeps router adminpages and API ports in public.

As powerful as a RouterBOARD is in terms of speed, it is not its strong point to do parallel or internal calculations, a high volume of attempts saturates the CPU very easily... More than a certain number at a time cannot be handled... The calculation is "wrong"... Presented this way, it's enou…

[image] infabo: Bruteforce prevention | RouterOS Manual But isn’t that for a brute-force SSH attack from the inside (LAN)? … From the outside (WAN), can’t I just block SSH with a ‘drop’?

The problem always comes down to: "Who left the door open?"

That is just an example from the manual. It can be used for any firewall port.

If Mikrotik applies a delay that is shared between sessions, I'll submit a CVE for a DoS vulnerability, where a malicious actor can prevent authorized access and effective use of the API interface by simply performing a sufficint number of incorrect authentication attempts against the endpoint. …

EUVD-2026-50017, CVE-2026-16347, GHSA-8v62-p5rj-72x6 - which RouterOS Version does fix that?

RouterOS General

infabo July 31, 2026, 6:28am 21

I think these insufficient rights re-evaluation issues are known for years. But nobody opened a CVE until....yesterday.