Your router is the front door to everything on your network, and it’s easy to forget it’s there. A new government warning about a popular router brand is a good excuse to give yours a quick checkup.
At a glance
- Who warned: CISA, the U.S. Cybersecurity and Infrastructure Security Agency
- Affected: MikroTik routers running RouterOS older than version 7.24 (per CISA)
- Risk: one crafted request could give an attacker full control, with no password needed
- Fix: update RouterOS. Current versions are 7.24.4 (stable) and 7.23.7 (long-term)
- Exploited yet? CISA said it knew of no attacks using it when it issued the warning
What happened
At the end of September, CISA warned about a flaw, tracked as CVE-2026-84411, in the web management page built into MikroTik’s RouterOS. An attacker who can reach that page can send a single specially crafted request and, in the worst case, run their own code on the router with full control, or simply knock it offline. MikroTik recommends updating, and BleepingComputer noted the company had not yet published its own security notice when the warning came out.
It isn’t MikroTik’s only recent problem. Poland’s national computer emergency team reported attackers chaining together other RouterOS flaws to take over routers that had remote login exposed to the internet.
Do you need to worry?
MikroTik is popular with small businesses, internet providers and tech hobbyists. If you have one, update it now. If you aren’t sure what brand your router is, look at the label on the bottom or the login page.
Even if this exact flaw doesn’t affect you, the lesson applies to every router: devices that are never updated and that can be reached from the internet are exactly what attackers look for.
A 10-minute router checkup
- Update the firmware. Many newer routers can update automatically. Turn that on.
- Change the default admin password. If it’s still what’s printed on the sticker, change it today.
- Turn off remote management unless you truly need to manage the router from outside your home or office.
- Use WPA3 or WPA2 encryption for Wi-Fi, never “open” or WEP.
- Put guests and smart devices on a separate network so a cheap smart plug can’t be used to reach your laptop.
- Check the age. If your router no longer gets updates from the manufacturer, it’s time to replace it.
Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers and networks for homes and small businesses. Email us at [email protected].
Sources: BleepingComputer, CISA advisory ICSA-26-272-06.
Comments
Join the HDT community to add comments
Enter your name and email and we’ll send you a sign-in link. No password needed. You’ll also get an email when we publish a new post, and you can unsubscribe anytime.