[MIKROTIK] Update your gear right now! All routers vulnerable!

1

You’ve read the title. Go and either update your gear or at least block port 8291 (open by default).

The vulnerability applies to all software versions from 6.29 to 6.43rc3 inclusive. It is necessary to update to the v6.42.1 or v6.43rc4.

Moreover you can’t check if you were affected as per their words:

Currently there is no sure way to see if you were affected. If your Winbox port is open to untrusted networks, assume that you are affected and upgrade + change password + add firewall. The log may show unsuccessful login attempt, followed by a succefful login attempt from unknown IP addresses.

The vulnerability is actively exploited since at least 3 days before the post on forums.

Source: Advisory: Vulnerability exploiting the Winbox port [SOLVED] - MikroTik

2

You should always block those ports on public facing networks on firewall level.
“Deny all, allow what you need” is what everyone should be doing.

2 Likes