MikroTik Router Vulnerabilities Can Lead to Backdoor Creation

[silversurfer]

Content source

https://www.securityweek.com/mikrotik-router-vulnerabilities-can-lead-backdoor-creation

A chain of vulnerabilities in MikroTik routers could allow an attacker to gain a backdoor. The chain starts with DNS poisoning, goes on to downgrading the installed version of MikroTik's RouterOS software, and ends with enabling a backdoor.

Tenable researchers found the vulnerabilities and disclosed two to MikroTik on September 11, 2019 (CVE-2019-3976 and CVE-2019-3977) and two more on September 13, 2019 (CVE-2019-3978 and CVE-2019-3979). It said, "By chaining these vulnerabilities, an unauthenticated remote attacker with access to port 8291 on the router, can perform a RouterOS downgrade, reset the system passwords, and potentially gain a root shell." MikroTik released patches on October 28, 2019.

MikroTik Router Vulnerabilities Can Lead to Backdoor Creation

A chain of vulnerabilities in MikroTik routers starts with DNS poisoning, goes on to downgrading the installed version of MikroTik's RouterOS software, and ends with enabling a backdoor.

www.securityweek.com

 

[SerialCart]

MikroTik Router Vulnerabilities Can Lead to Backdoor Creation

A chain of vulnerabilities in MikroTik routers starts with DNS poisoning, goes on to downgrading the installed version of MikroTik's RouterOS software, and ends with enabling a backdoor.

www.securityweek.com

This is not the first serious security issue that is discovered in Mikrotik products and services. I purchased a Mikrotik cloud some some years back to handle my VPNs but after some other security issues last year I switched to pfSense.

 

[bayasdev]

Thanks, I just upgraded my hAP ac2. I don't have any open port from outside so that should minimize the attack surface to an infiltrated into my main VLAN (I originally bought this thing to separate devices into different VLANs and bandwidth management).

 

[Cortex]

Also TP-Link Routers which aren't cheap have most infrequent firmware updates & are as trustworthy as an ex girlfriend I had - Most people often without realising use lots of IOT devices & common routers are virtually useless in protecting your network.

 

[bayasdev]

Also TP-Link Routers which aren't cheap have most infrequent firmware updates & are as trustworthy as an ex girlfriend I had - Most people often without realising use lots of IOT devices & common routers are virtually useless in protecting your network.

Mikrotik SOHO routers are on the same price range as a TP-LINK AC Gigabit router. $70 for a hAP ac2 vs $60 for the Archer A7. Also Mikrotik has advanced features and usually better hardware (quad core ARM on the ac2 vs single core MIPS on the A7) plus the advantage of getting security and feature updates regularly.