MikroTik RouterOS CVE-2023-30799: On the Dangers of Public Admin Interfaces

Censys reports that nearly 450,000 MikroTik RouterOS configuration interfaces on the Internet are running versions vulnerable to CVE-2023-30799, a post-authentication privilege escalation affecting RouterOS before 6.49.7 and long-term through 6.48.6. The report highlights widespread exposure amplified by default "admin" with no password settings, the ease of misconfiguration, historical targeting of MikroTik devices for botnets and proxying, and recommends patching, enforcing strong passwords, and removing public access to management interfaces.