Brute force attacks bypass connection delays to target MikroTik RouterOS API credentials

Summary

A vulnerability in the MikroTiK RouterOS API authentication mechanism allows attackers to perform repeated, high-volume login attempts without triggering effective defensive responses. The flaw stems from a lack of meaningful rate-limiting, account lockout mechanisms, or source-based restrictions within the system's authentication handling.

While some versions of RouterOS implement a fixed delay between connections, this defense can be bypassed by initiating multiple concurrent sessions. This behavior enables an attacker to maintain high-volume attempts, significantly increasing the likelihood of obtaining valid credentials for administrative services.

Technical details

The core issue resides in how RouterOS handles API authentication requests. The system lacks effective safeguards against excessive login attempts, which leaves it vulnerable to credential-guessing attacks.

Under normal circumstances, a fixed per-connection delay might slow down an automated attack. However, the current implementation of this delay does not account for concurrent sessions. An attacker can circumvent the intended slowdown by opening multiple simultaneous connections, effectively neutralizing the single-connection delay and allowing high-speed authentication attempts to proceed.

The vulnerability is tracked as CVE-2026-16347 and carries a CVSS score of 8.8 (High). The attack vector requires local or specific network access to interact with the API, but once accessed, the lack of account lockout or rate-limiting allows for sustained brute force activity.

Why this matters for defenders

The absence of account lockouts means that an attacker can attempt thousands of password combinations without being blocked by the system. Because concurrent sessions bypass the existing connection delay, standard automated scripts can be tuned to strike much faster than a single-threaded attack would suggest.

If an attacker successfully guesses administrative credentials through this method, they gain full control over the router's administrative services. This poses a direct threat to network integrity and management.

Defender guidance

To mitigate the risk of credential exhaustion and brute force attacks on the RouterOS API, implement the following controls:

• Restrict API Access: Do not leave the API open to all network segments. Use firewall rules to restrict access to specific, trusted IP addresses or management subnets.
• Monitor Connection Spikes: Watch for unusual patterns of concurrent sessions originating from a single source, as this is a primary method used to bypass the connection delay. s* Implement External Rate Limiting: Since the internal mechanism can be bypassed via concurrency, use external network security controls or firewalls to enforce strict rate-limiting on API ports.
• Audit Administrative Accounts: Ensure all administrative accounts use complex passwords that are resistant to brute force and review existing user lists for unauthorized entries.