PT-2018-1704

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 6.42.7 MikroTik RouterOS versions prior to 6.40.9 Description The issue is caused by memory corruption errors in the HTTP server of MikroTik RouterOS, specifically in the /nova/bin/www endpoint. An...

PT-2018-1702

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to 6.42.7 Mikrotik RouterOS versions prior to 6.40.9 Description The issue is related to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and, in some cases, reboot...

PT-2018-1701

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to 6.42.7 Mikrotik RouterOS versions prior to 6.40.9 Description The issue is caused by a stack buffer overflow in the license upgrade interface, specifically in the licupgr component, which could allow a remot...

CVE-2018-1156: Out-of-bounds Write

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system...

CVE-2018-1159: Improper Restriction of Operations within the Bounds of a Memory Buffer

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting...

CVE-2018-1158: Uncontrolled Recursion

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON...

CVE-2018-1157: Uncontrolled Resource Consumption

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request...

PT-2018-1703

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to 6.42.7 Mikrotik RouterOS versions prior to 6.40.9 Description The issue is related to a stack exhaustion vulnerability in the HTTP server of the RouterOS operating system. An authenticated remote attacker ca...

Mikrotik WinBox 6.42 - Credential Disclosure Exploit

Exploit for windows platform in category remote exploits Exploit Title: Mikrotik WinBox 6.42 - Credential Disclosure Metasploit Date: 2018-05-21 Exploit Authors: Omid Shojaei @Dmitriyarea51, Dark VoidSeeker, Alireza Mosajjal Vendor Page: https://www.mikrotik.com/ Sotware Link:...

Mikrotik WinBox 6.42 - Credential Disclosure (Metasploit)

Exploit Title: Mikrotik WinBox 6.42 - Credential Disclosure Metasploit Date: 2018-05-21 Exploit Authors: Omid Shojaei @Dmitriyarea51, Dark VoidSeeker, Alireza Mosajjal Vendor Page: https://www.mikrotik.com/ Sotware Link: https://mikrotik.com/download Version: 6.29 - 6.42 Tested on: Metasploit...

Mikrotik WinBox 6.42 - Credential Disclosure (Metasploit)

Mikrotik WinBox 6.42 - Credential Disclosure Metasploit Exploit Title: Mikrotik WinBox 6.42 - Credential Disclosure Metasploit Date: 2018-05-21 Exploit Authors: Omid Shojaei @Dmitriyarea51, Dark VoidSeeker, Alireza Mosajjal Vendor Page: https://www.mikrotik.com/ Sotware Link:...

MikroTik RouterOS Winbox Authentication Bypass (CVE-2018-14847)

An authentication bypass vulnerability exists in the Winbox component of Mikrotik RouterOS. A remote attacker could exploit this flaw by sending specially crafted packets to the affected server. Successful exploitation of this vulnerability would allow a remote attacker to hijack a user's session...

Directory traversal

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface...

CVE-2018-14847

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface...

CVE-2018-14847

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface...

CVE-2018-14847

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface...

CVE-2018-14847

CVE-2018-14847 is a WinBox directory-traversal vulnerability in MikroTik RouterOS that allowed unauthenticated remote file reads and, with authenticated access, file writes. Public PoCs/exploits (By the Way, WinboxExploit, MAC/RouterOS PoCs) demonstrate remote reading of the admin password and, i...

CVE-2018-14847

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface...

Mikrotik Winbox Arbitrary File Read

MikroTik RouterOS bugfix 6.30.1-6.40.7, current 6.29-6.42, RC 6.29rc1-6.43rc3 allows unauthenticated remote attackers to read arbitrary files through a directory traversal through the WinBox interface typically port 8291. Module Options msf use auxiliary/gather/mikrotik/winboxfileread msf...

CVE-2018-14847: Improper Limitation of a Pathname to a Restricted Directory

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface...