MikroTik RouterOS Unauthenticated Firewall & NAT Bypass Vulnerability

MikroTik RouterOS is the operating system for the MikroTik RouterBOARD hardware. A security vulnerability exists in MikroTik RouterOS versions prior to 6.43.12 stable and 6.42.12 long term. A remote, unauthenticated attacker could exploit this vulnerability to bypass the router's firewall or...

MikroTik RouterOS 6.43.12 (stable) 6.42.12 (long-term) - Firewall and NAT Bypass

MikroTik RouterOS 6.43.12 stable 6.42.12 long-term - Firewall and NAT Bypass CVE-2019-3924 A remote, unauthenticated attacker can proxy traffic through RouterOS via probes sent to the agent binary. This PoC demonstrates how to exploit a LAN host from the WAN. A video demonstrating the attack can ...

MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass

MikroTik RouterOS 6.43.12 stable / 6.42.12 long-term - Firewall and NAT Bypass CVE-2019-3924 A remote, unauthenticated attacker can proxy traffic through RouterOS via probes sent to the agent binary. This PoC demonstrates how to exploit a LAN host from the WAN. A video demonstrating the attack ca...

MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass

CVE-2019-3924 A remote, unauthenticated attacker can proxy traffic through RouterOS via probes sent to the agent binary. This PoC demonstrates how to exploit a LAN host from the WAN. A video demonstrating the attack can be found here: https://www.youtube.com/watch?v=CxyOtsNVgFg A Tenable Research...

PT-2019-1524 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: MikroTik RouterOS versions prior to 6.43.12 MikroTik RouterOS versions prior to 6.42.12 Description: The issue is related to privilege management errors in the operating system. It allows a remote attacker to bypass firewall policies. The...

Exploit for Path Traversal in Mikrotik Routeros

WinboxExploit This is a proof of concept of the critical WinBo...

The vulnerability of the HTTP-server on the RouterOS operating system of MikroTik allows a hacker to cause a service failure.

The vulnerability of the HTTP-server of the RouterOS operating system for MikroTik relates to buffer overflows in memory during recursive processing of JSON requests. Exploiting this vulnerability allows a malicious actor to cause a malfunction of the HTTP-server by using a specially crafted...

The vulnerability of the licupgr component in the RouterOS operating system of MikroTik allows a hacker to execute arbitrary code.

The vulnerability of the licupgr /nova/bin/licupgr component of the RouterOS operating system for MikroTik routers is caused by a buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially crafted request...

The vulnerability of the HTTP-server on the RouterOS operating system of MikroTik allows a hacker to cause a service failure.

The vulnerability of the HTTP server /nova/bin/www on MikroTik routers under the RouterOS operating system arises from errors in memory cleanup, which store information about initiated connections. Exploiting this vulnerability allows a remote attacker to cause a failure in the HTTP server by...

MikroTik RouterOS Winbox Unauthenticated Arbitrary File Read/Write Vulnerability

The remote networking device is running a version of MikroTik RouterOS vulnerable to an unauthenticated arbitrary file read and write vulnerability. An unauthenticated attacker could leverage this vulnerability to read or write protected files on the affected host. Nessus was able to exploit this...

Mikrotik RouterOS Memory Corruption Vulnerability

MikroTik RouterOS is a set of routing operating system developed based on Linux core by MikroTik Latvia. The system turns a PC computer into a professional router. A memory corruption vulnerability exists in Mikrotik RouterOS versions prior to 6.42.7 and prior to 6.40.9. A remote attacker could...

MikroTik RouterOS < 6.40.9 / 6.42.7 / 6.43 multiple vulnerabilities.

According to its self-reported version, the remote networking device is running a version of MikroTik prior to 6.40.9, 6.41.x 6.42.7, or 6.43. It, therefore, vulnerable to multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Mikrotik RouterOS Memory Exhaustion Vulnerability

MikroTik RouterOS is a set of routing operating system developed based on Linux core by MikroTik Latvia. The system turns a PC computer into a professional router. A memory exhaustion vulnerability exists in Mikrotik RouterOS versions prior to 6.42.7 and prior to 6.40.9. A remote attacker could...

Mikrotik RouterOS Stack Depletion Vulnerability

MikroTik RouterOS is a set of routing operating system developed based on Linux core by MikroTik Latvia. The system turns a PC computer into a professional router. A security vulnerability exists in Mikrotik RouterOS versions prior to 6.42.7 and prior to 6.40.9. A remote attacker can exploit the...

CVE-2018-1158

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON...

CVE-2018-1159

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting...

CVE-2018-1157

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request...

CVE-2018-14847

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface...

CVE-2018-14847

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface...

Mikrotik Winbox Arbitrary File Read

MikroTik RouterOS bugfix 6.30.1-6.40.7, current 6.29-6.42, RC 6.29rc1-6.43rc3 allows unauthenticated remote attackers to read arbitrary files through a directory traversal through the WinBox interface typically port 8291. Module Options msf use auxiliary/gather/mikrotik/winboxfileread msf...