PT-2025-6403 · Mikrotik · Routeros+1

Deauther890 · Published 2024-11-27 · Updated 2026-03-10 · CVE-2024-54772

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions 6.43 through 7.16.1

Description A discrepancy in response times between connection attempts made with a valid username and those with an invalid username in the Winbox service allows attackers to enumerate valid accounts.

Recommendations For versions 6.43 through 7.16.1, consider disabling the Winbox service until a patch is available to prevent attackers from enumerating valid accounts. Restrict access to the Winbox service to minimize the risk of exploitation. Avoid using the Winbox service for authentication until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

BDU:2025-16197

CVE-2024-54772

Affected Products

Mikrotik Routeros

Routeros

References · 12

• 🔥 https://github.com/deauther890/CVE-2024-54772 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54772 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54772 · Security Note
• https://bdu.fstec.ru/vul/2025-16197 · Security Note
• https://github.com/nmap/nmap/pull/2973 · Note
• https://t.me/cvenotify/111139 · Telegram Post
• https://mikrotik.com/supportsec/cve-2024-54772 · Note
• https://twitter.com/CVEnew/status/1889447054684070151 · Twitter Post
• https://reddit.com/r/mikrotik/comments/1ix7z7l/mikrotik_advisory_cve202454772 · Reddit Post
• https://t.me/cvenotify/127113 · Telegram Post
• https://t.me/cvedetector/17774 · Telegram Post