PT-2018-9655 · Mikrotik · Mikrotik

Farazpajohan + 1 · Publicado 2018-04-16 · Atualizado 2018-05-22 · CVE-2018-10070

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: MikroTik version 6.41.4

Description: A vulnerability could allow an unauthenticated remote attacker to exhaust all available CPU and RAM by sending a crafted FTP request on port 21 that begins with many '0' characters. This prevents the affected router from accepting new FTP connections, causing it to reboot after 10 minutes and log a "router was rebooted without proper shutdown" message.

Recommendations: For MikroTik version 6.41.4, consider restricting access to port 21 to minimize the risk of exploitation. As a temporary workaround, limit the use of FTP connections until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2018-10070

Produtos afetados

Mikrotik

Referências · 4

• 🔥 https://exploit-db.com/exploits/44450 · Exploit
• 🔥 http://packetstormsecurity.com/files/147183/MikroTik-6.41.4-Denial-Of-Service.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10070 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10070 · Aviso do Fabricante