SOC-L1-OSINT-Investigation-MikroTik-CVE-2018-1156

SOC L1 威胁调查：MikroTik RouterOS 多个暴露服务 分析师： Jonatan Alexander Guerrero Gomez | 目标角色： SOC L1 / 初级网络安全分析师 状态： 调查已结束 | 严重性： 高 执行摘要 主动威胁狩猎演练，识别出具有多个暴露服务的公网 MikroTik RouterOS 设备。调查将暴露在 2000/TCP 上的 Bandwidth-Test 服务与 CVE-2018-1156（一个高严重性 RCE 漏洞）关联起来。1701/UDP 上的 L2TP VPN 额外暴露增加了攻击面。此案例展示了 L1...

Mikrotrick_POC

RouterOS SSH 模数混淆验证器 CVE-2026-67276 一个自动化行为验证器，用于检测 MikroTik RouterOS 中的 SSH 公钥认证绕过漏洞 CVE-2026-67276。 该脚本通过使用仅匹配目标公钥模数的伪造签名建立握手，来测试 SSH 服务的不完整验证缺陷是否允许认证绕过。 漏洞概述 CVE-2026-67276 源于 RouterOS SSH 守护进程处理器中 RSA 公钥验证不完整。在处理客户端的公钥认证请求时，受影响版本仅匹配密钥类型和 RSA 公钥模数 $n$ ，而省略了对公钥指数 $e$ 的验证。 拥有目标用户已配置 授权公钥...

CVE-2026-89028

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a...

CVE-2026-56719

MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read...

CVE-2026-89028

MikroTik RouterOS versions before 7.24 are affected by a heap memory corruption vulnerability in the userspace SMB daemon. The root cause is an integer underflow triggered by a crafted uniPwdLen field in the SMB1 SessionSetupAndX handler, which causes an oversized copy length to be used when copy...

CVE-2026-89028 MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a...

EUVD-2026-80702

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a...

CVE-2026-56719

MikroTik RouterOS versions prior to 7.24 are affected by an out-of-bounds read in the userspace SMB daemon . The flaw is triggered by a crafted uniPwdLen field in a minimal SMB1 SessionSetupAndX frame, and the read occurs in the SessionSetupAndX handler before any credential validation , meaning ...

CVE-2026-56719 MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX

MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read...

EUVD-2026-80701

MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read...

CVE-2026-89021

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

CVE-2026-89020

MikroTik RouterOS before 7.23.4 long-term and 7.24.2 stable contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch comman...

CVE-2026-89021 MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

CVE-2026-89021 MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

EUVD-2026-77757

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

CVE-2026-89021

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package's OCI/tar image extraction . The root cause is unsanitized tar member path extraction during container import via /container/add, allowing an attacker to supply a crafted image with symlinks pointing ...

EUVD-2026-77756

MikroTik RouterOS before 7.23.4 long-term and 7.24.2 stable contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch comman...

CVE-2026-89020 MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path

MikroTik RouterOS before 7.23.4 long-term and 7.24.2 stable contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch comman...

CVE-2026-89020

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) is affected by a stack-based buffer overflow in the mtget binary's TFTP RRQ builder function. An authenticated user with read-only group membership can issue a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more ...

CVE-2018-5951

CVE-2018-5951: MikroTik RouterOS サービス拒否脆弱性 脆弱性概要 MikroTik RouterOS の脆弱性により、認証されていないリモート攻撃者がルーターを強制的に再起動させることができます。これは、IP プロトコル 97 を使用して RouterOS の IPv6 アドレスに 1 バイトのサイズのパケットを送信することで行われます。EoIPv6 をサポートするすべてのバージョンの RouterOS がこの攻撃に対して脆弱である可能性があります。この攻撃には、ターゲットシステムで IPv6 が有効であり、かつ少なくとも 1...