4 ms·

Mikrotik devices were reportedly affected as well, although I haven't seen any specific model identified (they all run pretty much the same software, although v

Mikrotik devices were reportedly affected as well, although I haven't seen any specific model identified (they all run pretty much the same software, although various models are based on different CPU architectures).

TeMPOraL 8y ago
I've read three articles about this today (this one included), and they all specified the same Mikrotik models: - Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072
- jlgaddis 8y ago
  You're right, I just got down to the bottom of the article and those models are listed there. I don't recall what article I read a day or two ago, but I don't believe it mentioned the specific models.
  - dboreham 8y ago
    As GP says, MT boxes all run the same software. The latest release (6.42.3) dated May 24 has suspiciously few bugfixes listed in the changelog. Probably worth updating on the basis the vulnerability fix is in there too.
- pilsetnieks 8y ago
  The original Cisco article mentions that these aren't all of the vulnerable models, just the ones they've seen. There isn't anything fundamentally different between a 1009 and a 1016.
sudouser 8y ago
damn, enterprise I used to work at uses mikrotik for critical services...
- pilsetnieks 8y ago
  So critical that they'd leave the web interface running on public IPs without firewalling? If not then they're probably safe.
  - dboreham 8y ago
    Is it known that the vulnerability is in the web UI? I ask because the CERT report advised to disable/ACL web UI but it didn't (afaik) say that this was the attach vector. They might have just thrown that in as sound general advice.
    - frankzinger 8y ago
      From their official forum post[1]: "Your devices are safe if the port 80 is firewalled, or if you have upgraded to v6.38.5 or newer." [1] https://forum.mikrotik.com/viewtopic.php?f=21&t=132499 https://forum.mikrotik.com/viewtopic.php?f=21&t=132499
MikusR 8y ago
Using a vulnerability fixed last March.

TeMPOraL 8y ago

I've read three articles about this today (this one included), and they all specified the same Mikrotik models: - Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072

jlgaddis 8y ago
You're right, I just got down to the bottom of the article and those models are listed there. I don't recall what article I read a day or two ago, but I don't believe it mentioned the specific models.
- dboreham 8y ago
  As GP says, MT boxes all run the same software. The latest release (6.42.3) dated May 24 has suspiciously few bugfixes listed in the changelog. Probably worth updating on the basis the vulnerability fix is in there too.
pilsetnieks 8y ago
The original Cisco article mentions that these aren't all of the vulnerable models, just the ones they've seen. There isn't anything fundamentally different between a 1009 and a 1016.

sudouser 8y ago

damn, enterprise I used to work at uses mikrotik for critical services...

pilsetnieks 8y ago
So critical that they'd leave the web interface running on public IPs without firewalling? If not then they're probably safe.
- dboreham 8y ago
  Is it known that the vulnerability is in the web UI? I ask because the CERT report advised to disable/ACL web UI but it didn't (afaik) say that this was the attach vector. They might have just thrown that in as sound general advice.
  - frankzinger 8y ago
    From their official forum post[1]: "Your devices are safe if the port 80 is firewalled, or if you have upgraded to v6.38.5 or newer." [1] https://forum.mikrotik.com/viewtopic.php?f=21&t=132499 https://forum.mikrotik.com/viewtopic.php?f=21&t=132499

MikusR 8y ago

Using a vulnerability fixed last March.