Can you give more detail on what you mean by the "recent Mikrotik CVE?" As far as I understood, the recent botnet was utilizing devices still unpatched since the original issue (2018?), as well as credentials gathered then even for patched devices that were affected but passwords weren't rotated.