Andre Santos

**Name of the Vulnerable Software and Affected Versions** MikroTik RouterOS (affected versions not specified) MikroTik Cloud Hosted Router (affected versions not specified) **Description** A weakness exists in the API authentication handling that lacks effective safeguards against excessive login attempts. The system fails to enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to occur without a defensive response. While some versions implement a fixed per-connection delay, this can be bypassed using concurrent sessions to maintain high-volume attempts, increasing the risk of unauthorized administrative access through credential discovery. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.