{"uuid": "2dd9660d-a4fd-4ce4-b26a-c72923fba16b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-67277", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/117264675753501005", "content": "We have started reporting out (daily) MikroTik instances with exposed proprietary services, such as WinBox & Bandwidth Test server (btest): https://www.shadowserver.org/what-we-do/network-reporting/accessible-mikrotik-service-report/\nAround 2.6M exposed instances shared daily. Top: Brazil, Indonesia, USA.\nTree map stats: https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=1&source=mikrotik&source=mikrotik6&data_set=count&scale=log&auto_update=on\nThese should not be publicly accessible on the Internet due to potential vulnerabilities, such as the recent CVE-2026-67277 https://nvd.nist.gov/vuln/detail/cve-2026-67277\nYou can find all our MikroTik detections in Device ID report https://www.shadowserver.org/what-we-do/network-reporting/device-identification-report/ (around 3M daily): https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=7&vendor=mikrotik&dataset=count&limit=100&group_by=geo&stacking=stacked&auto_update=on\nBackground: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "creation_timestamp": "2026-09-13T16:29:12.980951Z"}