Up until version 6.49.8 (July 20, 2023), MikroTik RouterOS Long-term was vulnerable to CVE-2023-30799. Remote and authenticated attackers can use the vulnerability to get a root shell on the router.

  • skysurfer@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    This only seems to impact instances that have Webfig or Winbox exposed to the attacker and not on the latest Long-term release. As long as those are not exposed to the internet the risk is minimal.

    Sadly, as the article pointed out, it seems that potentially hundreds of thousands of vulnerable instances are exposed to the internet.

    • rayman30@lemmy.worldOPM
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Makes me wonder why the default config enables those services on the outside interface anyway.