Re: [FD] Three vulnerabilities found in MikroTik's RouterOS

[update 2022/05/30] Two CVEs have been assigned to these vulnerabilities. CVE-2021-36613: Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). CVE-2021-3

[FD] Three vulnerabilities found in MikroTik's RouterOS

Advisory: three vulnerabilities found in MikroTik's RouterOS Details === Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: fixed version released CVE: - Credit: Qian Chen(@cq674350529) from Codesafe Team of Legendsec at Qi'anxin Group Product Description ===

Re: [FD] Three vulnerabilities found in MikroTik's RouterOS

Got it! Thank you for the explanation! On Sat, May 8, 2021 at 4:53 AM Q C wrote: > Hi, > > In Mikrotik RouterOs, each user is assigned to a user group, which denotes > the rights of this user. A group policy is a combination of individual > policy items, and provides a convenient way to assign d

Re: [FD] Three vulnerabilities found in MikroTik's RouterOS

Hi, In Mikrotik RouterOs, each user is assigned to a user group, which denotes the rights of this user. A group policy is a combination of individual policy items, and provides a convenient way to assign different permissions and access rights to different user classes.(Reference: https://help

Re: [FD] Three vulnerabilities found in MikroTik's RouterOS

Hi, I might be missing something, but how are these considered vulnerabilities? My point is that these require authentication, and an already authenticated user already has permissions to reboot the device anyway, right? If the above assumption is correct, then there isn't really a security bound

Re: [FD] Three vulnerabilities found in MikroTik's RouterOS

[Update 2021/05/04] Three CVEs have been assigned to these vulnerabilities. CVE-2020-20266: Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL pointer derefe

Re: [FD] Three vulnerabilities found in MikroTik's RouterOS

[update 2021/05/04] Three CVEs have been assigned to these vulnerabilities. CVE-2020-20215: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory

[FD] Three vulnerabilities found in MikroTik's RouterOS

Advisory: three vulnerabilities found in MikroTik's RouterOS Details === Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: fixed version released CVE: - Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team Product Description == RouterOS is

[FD] Three vulnerabilities found in MikroTik's RouterOS

Advisory: three vulnerabilities found in MikroTik's RouterOS Details === Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: fixed version released CVE: - Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team Product Description == RouterOS is