Security researchers disclosed two vulnerabilities in MikroTik RouterOS, the software on a widely used brand of network routers, that can be chained together, dubbed "MikroTrick," to give an attacker full administrative control of an internet-exposed router without any password or key. US authorities added the flaws to their official Known Exploited Vulnerabilities catalogue, a list of bugs known to be under active attack.
A router sits between a business and the internet, so control of it means control of all the traffic passing through.
What it means: network gear is easy to install and then forget, which is exactly why it is targeted. Any business with its own router should check the make and model against the must-patch list and apply the vendor's firmware update, or ask whoever manages the network to confirm it is done.