RouterOS management-plane exposure: measuring the SSH precondition

The September 2026 RouterOS vulnerabilities did not affect every MikroTik device equally. They affected devices whose administrative access was reachable from the internet. That condition, rather than the product name, defines which systems deserve the first hours of response.

Why SSH reachability is the deciding variable

The CERT Polska advisory of 5 September 2026 describes two flaws that combine in the SSH path. One let an unauthenticated client enter the connection protocol after a rekey and send an exec request; the other allowed the trusted RouterOS policy mask to be changed through a username handling error in the login path. The advisory states that exploitation required an unauthenticated SSH session to reach the RouterOS login helper. Reachability of SSH is therefore not a proxy for risk. It is the risk condition.
Externally measuring it converts a vague concern about a router fleet into a countable subset.

Measuring the subset

Four queries completed against live ZoomEye data on 15 October 2026 with sub_type=all:
| Query | Matching instances |
| --- | ---: |
| app="MikroTik RouterOS" && port="22" | 505545 |
| service="ssh" && app="MikroTik RouterOS" | 831147 |
| os="RouterOS" && port="22" | 9536 |
| app="MikroTik RouterOS" && port="8291" | 573 |
The first query is the tightest match to the published precondition: product fingerprint plus the SSH port. The second is broader because it matches any RouterOS asset for which SSH was identified as a service, including cases where the service was observed on a non-standard port. The third swaps the product fingerprint for the operating-system field and returns a much smaller set, which shows how sensitive these counts are to the identifier.
The port="8291" query is a separate observation. Port 8291 is the RouterOS management service, not SSH, and it is not the port named in the disclosure. Its count illustrates a different management surface on the same product and must not be added to the SSH figure.

Reading the numbers carefully

A count of external SSH reachability is not a count of compromised devices. It is not even a count of vulnerable devices, because banner data does not establish the RouterOS version. The reported figure of roughly 122,500 MikroTik devices exposing SSH, attributed to Shadowserver scanning and quoted in secondary coverage of the disclosure, is a different measurement taken on a different date with a different method. Report it as a separate observation rather than merging it with the counts above.

Implications

For triage, the SSH-reachable subset is the population to shrink. Every reduction in that subset directly removes the precondition described in the advisory, whether by firewalling the port, moving administration to a management network, or disabling the service where it is not needed. A baseline count, dated and reproducible, makes that reduction measurable rather than assumed.