A flaw in one brand of router let a stranger take full control of it with a single request and no password. The fix is a firmware update. Updating is the easy half. The half nobody gets round to is finding out whether someone was already in.
A router is a small computer that happens to have an antenna. Like every computer, it runs software, and like every computer, that software can have faults in it. What makes a router unusual is that it sits between you and everything else, and it is almost never updated.
This is about the step that comes after the update: working out whether your router’s own settings page was ever open to the internet, and whether anything is sitting on it now.
What an open door actually looks like
Your router’s settings page is usually at something like 192.168.1.1. That address only exists inside your house. On the average home network, nobody on the internet can reach it, and that is the normal, safe arrangement.
It can stop being true in several ordinary ways:
- Remote management switched on. Many routers have a setting, often called remote access or web access from WAN, that deliberately exposes the admin page. Sometimes it is on by default. Few people know it exists.
- Universal Plug and Play. UPnP lets devices open their own ports without asking you. It is convenient, and it is also how a device with a fault opens a way in.
- A port forward you set up and forgot about. You forwarded port 443 once to reach something at home, and the rule is still there.
- A router supplied by your internet provider, where the controls you can see are fewer than the ones that exist.
The point is not that any of these is definitely bad. The point is that you may not know which of them applies to you, and neither does anyone else. A model lookup tells you whether your router is the kind that gets attacked. It says nothing about whether yours can be reached.
The bug that made this worth writing about
A fault has been disclosed in RouterOS, the operating system MikroTik uses. The flaw is in WebFig, which is MikroTik’s name for the router’s own web admin page.
In plain terms: the software mishandles the size of an incoming request. If a request is a particular shape, the router’s own code gets confused while working out how much room it needs, and a stranger can make it run their instructions instead. It happens before any password is asked for, which is what makes it serious rather than ordinary. It can also just crash the router.
The numbers: it affects RouterOS versions before 7.24, and it scores 9.8 out of 10 on the standard severity scale. A single request is enough.
Discover the fix and something odd happens. Publicly reported fixed versions disagree with each other. One advisory’s own remediation text names a build inside the range it describes as vulnerable. The reliable instruction is the simple one: update to 7.24 or later, and check the actual version list on MikroTik’s own download page rather than trusting any summary, including this one.
Two things worth separating, because they are easy to blur together. This is a different flaw from the group fixed in RouterOS 7.24.2 and 7.23.4, and different again from a separate TLS configuration problem. If you read a roundup that treats them as one story, it is describing three.
Also worth knowing: at the time it was published, the US government advisory stated there were no reports of this being exploited in the wild. Read that as “nobody has reported it yet”, not as “nobody is doing it”.
Two more vendors, two more answers
The same period produced two more examples, and the contrast between them is the useful part.
Asus published an advisory covering two flaws in its router firmware. The first is in the part of the admin page that imports a VPN configuration file, where a file built to exploit it can run code on the router. Unlike the MikroTik fault, this one needs you to already be logged in - so it is a flaw that turns a mundane action into a risk. It is a repeat of the same weakness that was exploited through a malicious VPN profile two years earlier, which tells you the file import is a recurring soft spot, not a one-off bug. Asus’s advice is the sensible version of it: only import VPN profiles you got from a source you trust, and use a long, unique admin password.
The second is more careless. Debug code left in the firmware lets someone switch on Telnet, an old remote-access service, with full administrator rights.
Zyxel is the third example and the least comforting, because its flaw is already being used on real routers.
Put the three side by side and you have the whole range of vendor behavior in one place. One publishes an advisory with fixed builds and a self-check tool. One publishes an advisory with a firmware series and plain-language advice. One has been exploited in the wild. And plenty of makers of quite cheap routers never say anything at all, which is why “is my model on a list” produces such an unsatisfying answer: the list only contains the companies that told somebody.
Why patching is only step one
Here is the uncomfortable arithmetic. A flaw exists from the moment the code is written. It becomes public when it is disclosed. Your router is fixed when you install the update.
Between “publicly known” and “you updated” there is a gap. Attackers work in that gap, because a published flaw comes with a recipe attached. Every router in the world is the same shape, they are scanned constantly, and the ones that are never updated stay useful for years - which is where large parts of the internet’s background noise comes from.
So updating is genuinely step one, and it is the step that matters most. It just does not answer the question you are probably actually asking, which is whether this was going on before you got round to it.
If you run a MikroTik, this is the check
MikroTik has published its own method for finding out whether a router was touched. It looks for leftovers from the exploitation method it knows about.
Signs to look for, in the order the vendor lists them:
- A marker reading Flagged in the output of
/system/device-mode/print. This is the router’s own note that its device-mode settings were altered. - A user account named
ops, which is not a standard account name. - Log entries shaped like
login failure for user -2 from <an address> via ssh. A user numbered minus two is not a person. - Users, scripts, scheduled jobs, or proxy settings that nobody in the house created. A scheduled job that runs on a timer and downloads something is the one to look at hardest.
Two things matter about this list.
The second is simple: if the symptom is a scheduled job or a strange account, you are not looking for clues any more, you are looking at the thing itself.
If your router’s settings page was ever reachable from the internet, what you are doing is a compromise assessment, not a lookup. Those are different jobs, and the second one is not a yes-or-no answer.
What to do now
- Update the router. For MikroTik, 7.24 or later. For Asus, the firmware series named in its advisory. Get the version from the vendor’s own site.
- Check whether the admin page is reachable from outside. Turn remote management off if it is on and you have no reason for it. Check your port forwards for rules you do not recognize.
- Change the admin password to something long and unique. This does not fix an unauthenticated flaw, but it removes the second-easiest way in.
- Look at who and what is on the router. The user list, the scheduled jobs, the scripts. On any brand, an account or a job you did not create is the finding.
- If it was exposed and you find anything you do not recognize, factory reset it and set it up again with the new firmware and a new password. That is the only clean answer once a router has been changed by someone else.
None of this needs a new router. It needs one update and about twenty minutes with the settings page.
How we wrote this
The flaw descriptions, version ranges, severity scores and vendor advice come from the vendors’ own advisories and from the government advisory service that republishes them. None of it was tested on hardware here, and no article can tell you what happened on your own network. The check itself is MikroTik’s published method, quoted from their advisory rather than summarized from someone else’s summary of it.
Next: if you are still deciding whether the router you have is worth keeping, the five-minute firmware check covers the update-or-replace ladder, and network security basics covers what actually matters on a home network.