PT-2020-1957 · Mikrotik · Routeros+1

Published 2020-03-19 · Updated 2021-07-21 · CVE-2020-10364

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions through 6.44.3

Description The issue is related to uncontrolled resource management in the SSH daemon of MikroTik routers. This could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls.

Recommendations For versions through 6.44.3, update to a version later than 6.44.3 to resolve the issue. As a temporary workaround, consider restricting access to the SSH daemon to minimize the risk of exploitation.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

BDU:2020-01255

CVE-2020-10364

Affected Products

Mikrotik Routeros

Routeros

References · 7

• 🔥 https://exploit-db.com/exploits/48228 · Exploit
• 🔥 https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-10364 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10364 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01255 · Security Note
• https://t.me/cvenotify/2007 · Telegram Post
• https://t.me/cvenotify/15011 · Telegram Post