Most of those CVE start with
“An authenticated remote attacker can …”
How to solve 99,99% of problems:
Delete/rename default admin account, do not use standard or intuitive names for administrative account and use strong passwords
Do not open ports to the world, use VPN for remote mamagement
do not use weak VPN
do not use winbox or dude or browser for store passwords… or better do not store passwords
New CVE-2022-031901 affecting all version:
“An authenticated local or remote attacker, with administrative privileges, can reset routerboard with /system reset-configuration”
New CVE-2022-031902 for Windows 11:
“An authenticated or not local attacker can destroy the device putting the water inside…”