WARNING: CRITICAL VULNERABILITY IN MIKROTIK ROUTEROS
CVE-2023-30799
CVSS score : 9.1 (critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Sources
https://mikrotik.com/download/changelogs/long-term-release-tree
https://mikrotik.com/download/changelogs/stable-release-tree
https://www.bleepingcomputer.com/news/security/super-admin-elevation-bug-puts-900-000-mikrotik-devices-at-risk/
Risks
By successfully exploiting CVE-2023-30799, a remote and authenticated attacker could escalate privileges from admin to super-admin, which would enable them to execute arbitrary code.
It is important to note that admin credentials for RouterOS can be guessed relatively easily, because:
- RouterOS ships with a fully functional admin user by default
- RouterOS does not impose admin password strengthening requirements – which makes it vulnerable to brute-forcing attacks
Description
MikroTik RouterOS is the operating system of MikroTik RouterBOARD hardware. MikroTik RouterOS has different user privileges, including admin and Super Admin accounts. While an admin account has restricted elevated privileges, a Super Admin account gives full access to the RouterOS operating system.
CVE-2023-30799 is a vulnerability in RouterOS that could enable an attacker to elevate privileges from admin to Super Admin. This makes it possible for the attacker to make changes to the underlying operating system and/or hide activities from detection.
Recommended Actions
MikroTik recommends upgrading your software:
- MikroTik RouterOS stable v6.49.7
- MikroTik RouterOS long-term v6.49.8
It is also considered good practice to:
- Remove administrative interfaces from the internet
- Restrict login IP addresses to a defined allow-list
- Disable Winbox and only use SSH
- Configure SSH to use public/private keys instead of passwords