"Over 900,000 MikroTik Routers Exposed to Critical Bug"

Security researchers at VulnCheck have warned that hundreds of thousands of routers produced by Latvian networking equipment maker MikroTik are vulnerable to a critical bug that could enable attackers to remotely control affected devices.  The researchers noted that remote and authenticated attackers can use CVE-2023-30799 to get a root shell on MikroTik RouterOS routers.  The vulnerability itself was first disclosed in June 2022 but only assigned a CVE after VulnCheck published new exploits.  The researchers noted that a patch is now available, but the researchers claimed that around 472,000 RouterOS devices globally are still vulnerable via their web management interface, with the figure rising to more than 920,000 if exploitation happens via the Winbox management client.  The vulnerability itself is a privilege escalation bug with a CVSS score of 9.1.  The researchers stated that a remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface.  The attacker can abuse this vulnerability to execute arbitrary code on the system.  The researchers warned that although exploitation of the bug requires authentication, this is easier than one might think.  VulnCheck claimed around 60% of RouterOS users are still running a default admin user.
 

Infosecurity reports: "Over 900,000 MikroTik Routers Exposed to Critical Bug"