Orta ÖNEM — Güvenlik Açığı

CVE-2024-54772 — An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stabl

An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.

Platform
MikroTik RouterOS
CVE Kaydı
CVE-2024-54772
CVSS Skoru
5.4/10
Yayın Tarihi
11 Şubat 2025
Okunma
2
Birincil kaynak: Kaynaktaki resmî duyuruyu inceleyin: nvd.nist.gov Kaynağa Git

Özet

An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.

Değerlendirme

  • CVE: CVE-2024-54772
  • CVSS taban puanı: 5.4
  • Vektör: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
  • Kaynak: NVD kaydı

Referanslar

Aksiyon

  • Etkilenen sistemleri envanterden doğrulayın
  • Üretici yamasını bakım penceresinde uygulayın
  • Yama uygulanana kadar erişimi ağ katmanında kısıtlayın
routeros *

MikroTik RouterOS — İlgili Duyurular

TÜMÜNÜ GÖR →
MikroTik RouterOS 25 Haz 2025
Yüksek · 7.2

CVE-2025-6443 — Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability.

Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress t

CVE-2025-6443 Güvenlik Açığı 1
MikroTik RouterOS 03 May 2024
Yüksek · 7.5

CVE-2023-32154 — Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability.

Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An

CVE-2023-32154 Güvenlik Açığı 2