Exploiting MikroTik RouterOS Hardware with CVE-2023-30799 - Blog - VulnCheck
vulncheck.com
VulnCheck develops an exploit that gets a root shell on MikroTik RouterOS.

Up until version 6.49.8 (July 20, 2023), MikroTik RouterOS Long-term was vulnerable to CVE-2023-30799. Remote and authenticated attackers can use the vulnerability to get a root shell on the router.

  • @skysurferEnglish
    2•1 year ago

    This only seems to impact instances that have Webfig or Winbox exposed to the attacker and not on the latest Long-term release. As long as those are not exposed to the internet the risk is minimal.

    Sadly, as the article pointed out, it seems that potentially hundreds of thousands of vulnerable instances are exposed to the internet.

    • @rayman30OPMEnglish
      1•1 year ago

      Makes me wonder why the default config enables those services on the outside interface anyway.