3 ms·

I would definitely not use a Mikrotik router, they just recently had an RCE [0]. And apparently they encrypt user passwords! [1] [0] https://nvd.nist.gov/vuln/

I would definitely not use a Mikrotik router, they just recently had an RCE [0]. And apparently they encrypt user passwords! [1] [0] https://nvd.nist.gov/vuln/detail/CVE-2018-7445 https://nvd.nist.gov/vuln/detail/CVE-2018-7445 [1] https://forum.mikrotik.com/viewtopic.php?t=133533#p656301 https://forum.mikrotik.com/viewtopic.php?t=133533#p656301

Lionsion 9y ago
What would you use then? I don't think a manufacturer should be judged too harshly based on if they have vulnerabilities or not, since all software does, but rather on how they respond to and patch those vulnerabilities.
Someone1234 9y ago
So which major vendor hasn't had a RCE on the LAN side? Even my current Asus router had an RCE on the LAN side a couple of years ago... MikroTik fixed both of the issues you referenced, just as Asus fixed the issue I referenced. So I see no specific reason not to use either a MikroTik or a Asus device (and keep both up to date). The only major thing I'd consider is: - Does the manufacturer respond constructively? - Is the device still receiving security updates/has no outstanding holes?
- rhinoceraptor 9y ago
  Considering that they can't even get user authentication right, I have pretty big doubts about the rest of their security. Hashing/salting passwords is not a new concept.
  - carlhjerpe 9y ago
    It's hard to defend something like this, but i think it's important to know that this only affects MikroTik devices with the SMB service enabled (disabled by default). It's very bad, but they responded quickly and resolved the issue. One thing i'd say is worth mentioning is that they're still keeping "all" (all i know off) RouterBoard devices updated. We've had customers with gear many many years old, still updated with feature and security upgrades.
dibbsonline 9y ago
I would definitely not run linux windows macos netgear cisco juniper because they once had a RCE.
deleted 9y ago
[deleted]

Lionsion 9y ago

What would you use then? I don't think a manufacturer should be judged too harshly based on if they have vulnerabilities or not, since all software does, but rather on how they respond to and patch those vulnerabilities.

Someone1234 9y ago

So which major vendor hasn't had a RCE on the LAN side? Even my current Asus router had an RCE on the LAN side a couple of years ago... MikroTik fixed both of the issues you referenced, just as Asus fixed the issue I referenced. So I see no specific reason not to use either a MikroTik or a Asus device (and keep both up to date). The only major thing I'd consider is: - Does the manufacturer respond constructively? - Is the device still receiving security updates/has no outstanding holes?

rhinoceraptor 9y ago
Considering that they can't even get user authentication right, I have pretty big doubts about the rest of their security. Hashing/salting passwords is not a new concept.
- carlhjerpe 9y ago
  It's hard to defend something like this, but i think it's important to know that this only affects MikroTik devices with the SMB service enabled (disabled by default). It's very bad, but they responded quickly and resolved the issue. One thing i'd say is worth mentioning is that they're still keeping "all" (all i know off) RouterBoard devices updated. We've had customers with gear many many years old, still updated with feature and security upgrades.

dibbsonline 9y ago

I would definitely not run linux windows macos netgear cisco juniper because they once had a RCE.

deleted 9y ago

[deleted]