Get Started

External Network Pentest Scope: Beyond VPN Appliances

On September 10, 2026, CISA added two MikroTik RouterOS SSH vulnerabilities to its Known Exploited Vulnerabilities Catalog, confirming what CERT Polska had already published a week earlier: attackers were actively working an authentication bypass chain against internet-exposed routers, and any enterprise relying on annual scans rather than an active external network penetration test scope was likely running unpatched. For CISOs in EMEA, where MikroTik is heavily deployed as cost-effective routing infrastructure, this is not a theoretical CVE. It is a live perimeter finding.

The question CTDefense hears most often in the week after news like this is a simple one: would a real pentest have caught it, or does the current engagement stop at web apps and VPN gateways? The answer depends entirely on what the scope actually covered.

Edge Routers in Pentest Scope

An edge router security assessment is not the same as a VPN appliance review. VPN concentrators terminate remote-access sessions and typically carry a well-known list of exploitable CVEs at the appliance software layer. Edge routers, on the other hand, carry the traffic itself. SSH is the management interface, and if it is exposed to the internet, the router becomes a distinct finding class from the SSL VPN gateway sitting beside it. That distinction matters when the finding is triaged: how a pentest treats VPN appliance exposure is a different conversation from how it treats a network routing device.

A full-scope external pentest includes all internet-facing management interfaces, routers, switches, and firewalls, not just web apps and VPN gateways. This is one of the more common gaps CTDefense finds during a first engagement: the previous scope of work described “external network testing” but stopped at the load balancer and the SSL VPN, leaving management planes on network devices untouched.

MikroTik RouterOS is a useful example because the September 2026 chain (CVE-2026-67277 for missing authentication on a critical function, CVE-2026-86060 for the follow-on bypass) targets the SSH management interface directly. According to Help Net Security, the ShadowServer Foundation’s daily scan on 5 September counted more than 122,500 MikroTik devices with SSH reachable from the internet, with strong European representation. For any enterprise in that count, a scanner reports “port 22 open, patch available”. A pentest reports whether an unauthenticated attacker can reach administrative control and what they would do with it.

Discovery and Surface Enumeration

A senior tester begins internet-facing attack surface enumeration before touching a single packet. Passive discovery pulls from certificate transparency logs, WHOIS records, ASN allocations, reverse DNS on the client’s netblock, and BGP peering data. Active discovery follows: banner grabs against exposed ports, TLS certificate fingerprints, and version strings from services that respond to protocol handshakes.

RouterOS shows up in this stage because the SSH banner is distinctive. Version strings expose the firmware branch and, by extension, whether the device is in the vulnerable window (below the patched 6.49.15 and 7.16.2 lines). The team documents each device with three attributes:

Scanners perform a similar first pass, and that is where the resemblance ends. A scanner produces a list. The pentest engagement uses the list as a target set.

Testing the Authentication Bypass

Once the tester has identified an internet-exposed RouterOS SSH interface in the vulnerable version range, the next step is to prove exploitability. That is the difference between a scanner ticket and a pentest finding.

The authentication bypass in CVE-2026-67277 exploits a missing check on a critical function that should have required authentication. In practice, the tester issues the crafted request, observes the response, and then chains the follow-on flaw to reach a shell context on the device. The engagement records the exact request sequence, the response indicators, and the resulting access level.

CERT Polska’s published indicators of compromise are useful here. Their advisory noted that attackers observed in the wild created a highly privileged account named ops on compromised devices, and linked two attacker IP addresses to the campaign. During a pentest, the team will not create such an account, but the presence of one on a client device is a strong signal that exploitation has already happened, and the account name gives the SOC a concrete detection hook to backtest against RouterOS audit logs.

By the end of this step, the deliverable contains the exploitation sequence, the resulting administrative context, and evidence in a form the client’s network team can act on without ambiguity.

Lateral Movement and Remediation

Administrative access to an edge router is rarely the goal in itself. The next question the tester answers is what an attacker does from there. Common paths include modifying routing tables to redirect traffic through attacker-controlled infrastructure, adding IPsec tunnels for persistent access, altering firewall rules to expose internal services, and turning on packet capture to harvest credentials in transit. Where the router borders an internal network, the device can also become the pivot point into internal segments that were otherwise protected by the perimeter. Some of the same techniques surface in what attackers typically find when they map your external perimeter, so the finding often lands alongside adjacent perimeter issues in the same report.

The remediation guidance CTDefense delivers is specific:

NIS2 network security requirements under Article 21 also apply directly here. Essential and important entities in the EU are obligated to implement network security controls, and an unpatched internet-exposed router with a public CVE under active exploitation is a documented gap against that obligation. The pentest report gives the compliance and technical teams the same evidence to work from.

Pentest Report vs. Vulnerability Scanner

A perimeter device security assessment run as part of a real pentest produces something different from the CSV a scanner exports. A scanner flags CVE-2026-67277 as “port 22 open, patch available”; a pentest proves whether an unauthenticated attacker can chain that to full administrative access, and documents exactly what they could do next.

The report structure the team produces for external network engagements is consistent:

Cadence matters too. An external network pentest should run at minimum annually, and after any perimeter change or significant CVE affecting internet-facing devices. The MikroTik exploitation window, roughly 24 hours between active exploitation and an available patch, is a reasonable example of why a 12-month gap is too long for perimeter coverage.

CTDefense continues to support finance, manufacturing, and critical-infrastructure organisations across EMEA with External Network Security Audit engagements that cover every internet-facing management interface, not just web apps and VPN gateways. Similar organisations are encouraged to take a close look at their own external network penetration test scope, especially where cost-effective network devices such as RouterOS routers sit at the perimeter carrying management interfaces that a scanner treats as background noise.

Leave a Reply