MikroTik RouterOS and Cloud Hosted Router

# MikroTik's API Has No Brute-Force Defense — and Every Version Is Exposed

## The Threat

MikroTik routers are everywhere — in ISP backbones, corporate edge networks, home labs, and critical infrastructure. They run affordable, flexible hardware that network engineers trust. That ubiquity is exactly what makes CVE-2026-16347 worth taking seriously: every version of RouterOS and Cloud Hosted Router ships with an API authentication mechanism that puts up essentially no fight against brute-force attacks.

The flaw is in how the API service handles failed login attempts. There's no rate limiting. There's no account lockout. There's no source-based blocking that fires after repeated failures from the same IP. Some versions do impose a small per-connection delay, but an attacker can trivially route around it by opening concurrent sessions — a technique so basic it barely qualifies as an evasion. The net result is that an attacker with network adjacency and a decent wordlist can hammer credentials until something sticks.

What lands this in HIGH severity rather than CRITICAL is the attack vector: the flaw is classified Adjacent (AV:A), meaning the attacker needs to be on the same network segment or broadcast domain as the target. That's still a realistic threat in a surprising number of scenarios — shared hosting environments, compromised internal hosts pivoting laterally, or any MikroTik device whose API port is reachable from an untrusted VLAN. And for devices whose management services are directly internet-exposed (a misconfiguration MikroTik's own guidance warns against, but one that happens constantly in the field), the "adjacent" requirement collapses entirely.

## Severity and Impact

| Field | Detail |

|---|---|

| CVE | CVE-2026-16347 |

| CWE | CWE-307 — Improper Restriction of Excessive Authentication Attempts |

| CVSS 3.1 Score | 8.8 HIGH |

| CVSS 3.1 Vector | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

| CVSS 4.0 Score | 8.7 HIGH |

| CVSS 4.0 Vector | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |

| Attack Complexity | Low |

| Authentication Required | None |

| User Interaction | None |

| Confidentiality / Integrity / Availability Impact | High / High / High |

| Reported By | Andre Santos, União Geek (via CISA) |

## Affected Products

All versions of both product lines are confirmed affected. There is no patched version available at time of publication.

Deployment scope: worldwide, across Information Technology and Commercial Facilities critical infrastructure sectors.

## Mitigations

No vendor patch exists. MikroTik's guidance focuses on hardening the deployment environment:

Immediate steps:

Credential hardening:

Configuration controls (when available in your version):

Network segmentation:

Contact MikroTik support directly at [mikrotik.com/support](https://mikrotik.com/support) for further guidance.

## References

---

## HackWire Analysis

The fact that there's no patch is the headline within the headline. MikroTik has acknowledged the vulnerability but hasn't shipped a fix, leaving the entire RouterOS and CHR install base in a pure-mitigation posture for however long that takes. That's a meaningful exposure window given how widely these devices are deployed at the network perimeter.

What makes CWE-307 particularly aggravating here is how unambiguous a control problem it is. Rate limiting and lockout logic aren't exotic security features — they're table stakes that have appeared in OWASP guides for over a decade. The partial per-connection delay that *can* be bypassed via concurrent sessions suggests someone knew the problem existed and shipped an insufficient fix. That's a different kind of failure than simply overlooking the issue.

MikroTik has a complicated history with security disclosure response. Their devices attract heavy attention from threat actors — Fancy Bear's 2023 infrastructure campaigns, the Meris botnet, various scanning operations against Winbox — because routers make ideal pivot points and command-and-control relays. Brute-forcing the API on a poorly defended device gets an attacker a persistent foothold with routing-level visibility into the network.

For defenders, the practical lesson is that "adjacent network" shouldn't be confused with "unreachable." Any environment where a MikroTik device shares broadcast segments with untrusted endpoints — guest Wi-Fi, shared colocation, multi-tenant environments — should treat this as a network-level critical. Patch cadence for network infrastructure is historically poor; now is the time to audit exactly which MikroTik services are exposed and to what.

— HackWire Editorial

## Related Coverage