The vulnerability lies in MikroTik RouterOS and Cloud Hosted Router API authentication handling. Because the system does not enforce rate‑limiting, account lockout, or source‑based restrictions, an attacker can repeatedly submit login attempts without triggering any defensive response. This flaw allows a legitimate attacker to recover valid credentials through brute force, eventually gaining full administrative control over the device and the network configurations it manages. The weakness is a classic implementation of CWE‑307, which involves insecure authentication mechanisms.

The affected entities are MikroTik RouterOS firmware and the MikroTik Cloud Hosted Router. Specific compatible versions are not listed in the data, so the flaw may be present in current releases and earlier ones. Administrators should treat all RouterOS and Cloud Hosted Router deployments as potentially exposed until they ascertain the exact version scope.

With a CVSS score of 8.7, the flaw is classified as high severity, indicating significant potential impact on confidentiality, integrity, and availability. The EPSS score of less than 1% reflects a low but non‑zero exploitation likelihood in the wild, and the vulnerability is currently not listed in the CISA KEV catalog. Attackers can reach the exposed API over public networks, as described in the CVE text; this inference about the attack surface is drawn directly from the vulnerability description, implying that the main vector is unauthenticated attempts to the API interface.