we have a RouterOS v6.38.5 router that has been hacked today and deleted to the default settings. Also via the winbox port ... We think there is a circular second exploit that works in a similar way to this.