Serious Vulnerability in Mikrotik Devices

The company Tenable released a report a few days ago about a series of vulnerabilities in Mikrotik devices, exploitation of which allows gaining control over the device. Mikrotik routers are widely used not only in corporate networks and home installations - many of the manufacturer’s devices also operate in data centers, providing corporate VPN access.

To compromise a router, access to the Winbox port (tcp/8291) is necessary, which is used to connect the external device configuration utility. An attacker can substitute the software update servers and upload either firmware with a default password or generate a special update package containing malicious code.

This series of vulnerabilities has been assigned the identifiers CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979. The developer has already released software updates for Mikrotik devices, with RouterOS versions containing fixes numbered 6.45.7 (stable), 6.44.6 (long-term), and 6.46beta59 (testing).

We recommend that all users of Mikrotik products urgently schedule and perform an update for RouterOS. It is also advisable to disable Winbox support or to use filters to restrict access via this protocol only from trusted IP addresses.

Read more:

• PACKAGE VALIDATION AND UPGRADE VULNERABILITY
• DNS CACHE POISONING VULNERABILITY
• RouterOS: Chain to Root
• Backport Vulnerability in RouterOS Threatens Hundreds of Thousands of Devices