Mikrotik

220 readers

8 users here now

A community-contributed sublemmy for all things Mikrotik. General ISP and network discussion also permitted. Please ensure if you're asking a question you have checked the Wiki First: https://help.mikrotik.com

Mikrotik Rules: Don't post content that is incorrect or potentially harmful to a router/network.

This in itself is not a bannable offence but answers that are verifiably incorrect or will cause issues for other users will be edited or removed.

Examples: Factual errors - "EOIP is always unsecure" Configuration problems - Config that would disable all physical interfaces on a router Trolling - "Downgrade it to 5.26"

founded 1 year ago

MODERATORS

rayman30

Exploiting MikroTik RouterOS Hardware with CVE-2023-30799 (vulncheck.com)

submitted 1 year ago by rayman30 to c/mikrotik

2 comments fedilink hide all child comments

Up until version 6.49.8 (July 20, 2023), MikroTik RouterOS Long-term was vulnerable to CVE-2023-30799. Remote and authenticated attackers can use the vulnerability to get a root shell on the router.

you are viewing a single comment's thread
view the rest of the comments

[–] skysurfer 2 points 1 year ago (1 children)

This only seems to impact instances that have Webfig or Winbox exposed to the attacker and not on the latest Long-term release. As long as those are not exposed to the internet the risk is minimal.

Sadly, as the article pointed out, it seems that potentially hundreds of thousands of vulnerable instances are exposed to the internet.

[–] rayman30 1 points 1 year ago

Makes me wonder why the default config enables those services on the outside interface anyway.