PT-2023-2059 · Mikrotik · Mikrotik Routeros

Dl · Published 2023-01-12 · Updated 2025-02-19 · CVE-2023-24094

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS version 6.40.5

Description The issue in the bridge2 component of MikroTik RouterOS is related to errors in resource release, which can be exploited by attackers to cause a Denial of Service (DoS) via crafted packets. This can be achieved by a remote attacker sending specially formed packets.

Recommendations For MikroTik RouterOS version 6.40.5, consider disabling the bridge2 component as a temporary workaround until a patch is available. Restrict access to the bridge interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Resource Release

Memory Corruption

Weakness Enumeration

CWE-404

CWE-787

Related Identifiers

BDU:2023-01782

CVE-2023-24094

Affected Products

Mikrotik Routeros

References · 9

• 🔥 https://github.com/ZYen12138/RouterOS/blob/main/CVE-2023-24094.md · Exploit
• https://bdu.fstec.ru/vul/2023-01782 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-24094 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24094 · Vendor Advisory
• https://t.me/cibsecurity/60780 · Telegram Post
• https://vuldb.com/ru/?id.224063 · Note
• http://routeros.com · Note
• http://mikrotik.com · Note
• https://t.me/cvenotify/111817 · Telegram Post