MikroTik Router OS Directory Traversal Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-12-01
• EPSS: 96% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.1

[ Description ]Official description

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 1 Jun 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/BasuCert/WinboxPoCExploitMitigationThird Party Advisory
• github.com/BigNerd95/WinboxExploitExploitMitigationThird Party Advisory
• github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdfBroken LinkExploitThird Party Advisory
• github.com/tenable/routeros/tree/master/poc/bythewayExploitThird Party Advisory
• github.com/tenable/routeros/tree/master/poc/cve_2018_14847ExploitThird Party Advisory
• mikrotik.com/supportsec/winbox-vulnerabilityVendor Advisory
• n0p.me/winbox-bug-dissectionExploitThird Party Advisory
• www.exploit-db.com/exploits/45578ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource