PT-2023-2059 · Mikrotik · Mikrotik Routeros

Dl · Publicado 2023-01-12 · Atualizado 2025-02-19 · CVE-2023-24094

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS version 6.40.5

Description The issue in the bridge2 component of MikroTik RouterOS is related to errors in resource release, which can be exploited by attackers to cause a Denial of Service (DoS) via crafted packets. This can be achieved by a remote attacker sending specially formed packets.

Recommendations For MikroTik RouterOS version 6.40.5, consider disabling the bridge2 component as a temporary workaround until a patch is available. Restrict access to the bridge interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Resource Release

Memory Corruption

Enumeração de Fraquezas

CWE-404

CWE-787

Identificadores relacionados

BDU:2023-01782

CVE-2023-24094

Produtos afetados

Mikrotik Routeros

Referências · 9

• 🔥 https://github.com/ZYen12138/RouterOS/blob/main/CVE-2023-24094.md · Exploit
• https://t.me/cibsecurity/60780 · Publicação no Telegram
• https://vuldb.com/ru/?id.224063 · Nota
• http://routeros.com · Nota
• https://bdu.fstec.ru/vul/2023-01782 · Nota de Segurança
• http://mikrotik.com · Nota
• https://t.me/cvenotify/111817 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-24094 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-24094 · Aviso do Fabricante