11 ms·

Well, this is concerning. I just bought a MicroTik RB4011 to replace my ol faithful Ubiquiti EdgeRouter X because I’m getting fiber installed next week… I gues

Well, this is concerning. I just bought a MicroTik RB4011 to replace my ol faithful Ubiquiti EdgeRouter X because I’m getting fiber installed next week… I guess I will be doing some research on MicroTik vulnerabilities and try to find out if these are just misconfigured devices that got owned or if I should hold off on the switch!

doubled112 5y ago
I don't see how you'd be owned if you're denying all outside traffic, but stranger things have happened. They don't all come with it configured this way by default, and it's definitely something to be aware of. The hAP AC^2, for example, has a button that rotates through 3 default configs. One of those configs is NAT home router/firewall, one of them is just router, and one of them is completely empty. At least, that's how I remember it working.
- somehnguy 5y ago
  > I don't see how you'd be owned if you're denying all outside traffic, but stranger things have happened. My thought was the same but yup you never know. From the outside my attack surface is very low, just a couple port forwards to a VPN/SSH server. It’s the non-obvious exploits that worry me (overflow in packet header parsing or borderline magic like that), but perhaps I’ve been watching too many movies :) I will make sure my config is as solid as I can reasonably make it before connecting it to the world, I guess outside of that there’s not a whole lot I can do anyway.
outworlder 5y ago
You may be interested in this thread: https://forum.mikrotik.com/viewtopic.php?f=21&t=178417 https://forum.mikrotik.com/viewtopic.php?f=21&t=178417 Edit: also this checker, when you get the device online: https://radar.qrator.net/ https://radar.qrator.net/ Unclear how old your firmware is, but it seems that the vulnerability was patched years ago. Check anyway.
- flutas 5y ago
  > Unclear how old your firmware is, but it seems that the vulnerability was patched years ago. Check anyway. That seems to be countered in the article mentioning that the majority of devices are running firmware that’s relatively recent (one release from the latest).
- somehnguy 5y ago
  Thanks, this was very helpful. My first move when I get a device like this is a firmware update, so I’ll do that and then check with the resource you linked.
taxyz23 5y ago
I installed a Mikrotik hap ac2 router a few months ago to replace a Netgear one. It has been working great impressed with the software, support, and wireless coverage particularly for such a tiny box with such a small price. But a complicated setup if you're not a network engineer and have some customizations to make for firewall and static IPS, forwarding, etc! Not at all as easy as ddwrtt, tomato or even pfsense. And very odd terminal command line not Linux typical. I updated my firmware a few weeks ago (press a button in software, easy) and my router does not have vulnerability per https://radar.qrator.net/ https://radar.qrator.net/. Was likely safe before also as link above states it was patched years ago.

doubled112 5y ago

I don't see how you'd be owned if you're denying all outside traffic, but stranger things have happened. They don't all come with it configured this way by default, and it's definitely something to be aware of. The hAP AC^2, for example, has a button that rotates through 3 default configs. One of those configs is NAT home router/firewall, one of them is just router, and one of them is completely empty. At least, that's how I remember it working.

somehnguy 5y ago
> I don't see how you'd be owned if you're denying all outside traffic, but stranger things have happened. My thought was the same but yup you never know. From the outside my attack surface is very low, just a couple port forwards to a VPN/SSH server. It’s the non-obvious exploits that worry me (overflow in packet header parsing or borderline magic like that), but perhaps I’ve been watching too many movies :) I will make sure my config is as solid as I can reasonably make it before connecting it to the world, I guess outside of that there’s not a whole lot I can do anyway.

outworlder 5y ago

You may be interested in this thread: https://forum.mikrotik.com/viewtopic.php?f=21&t=178417 https://forum.mikrotik.com/viewtopic.php?f=21&t=178417 Edit: also this checker, when you get the device online: https://radar.qrator.net/ https://radar.qrator.net/ Unclear how old your firmware is, but it seems that the vulnerability was patched years ago. Check anyway.

flutas 5y ago
> Unclear how old your firmware is, but it seems that the vulnerability was patched years ago. Check anyway. That seems to be countered in the article mentioning that the majority of devices are running firmware that’s relatively recent (one release from the latest).
somehnguy 5y ago
Thanks, this was very helpful. My first move when I get a device like this is a firmware update, so I’ll do that and then check with the resource you linked.

taxyz23 5y ago

I installed a Mikrotik hap ac2 router a few months ago to replace a Netgear one. It has been working great impressed with the software, support, and wireless coverage particularly for such a tiny box with such a small price. But a complicated setup if you're not a network engineer and have some customizations to make for firewall and static IPS, forwarding, etc! Not at all as easy as ddwrtt, tomato or even pfsense. And very odd terminal command line not Linux typical. I updated my firmware a few weeks ago (press a button in software, easy) and my router does not have vulnerability per https://radar.qrator.net/ https://radar.qrator.net/. Was likely safe before also as link above states it was patched years ago.