A critical 'Super Admin' vulnerability , which allows privilege elevation , puts 900,000 MikroTik RouterOS routers at risk . The vulnerability could allow attackers to take complete control of a device and remain undetected.
The vulnerability is tracked as CVE-2023-30799 and allows remote attackers with an existing administrator accountto elevate their privileges to “super-admin” via the device’s Winbox or HTTP interface.
A new report from VulnCheck explains that while the CVE-2023-30799 vulnerability requires an existing administrator account, we shouldn't be complacent. The Mikrotik RouterOS operating system unfortunately does not prevent password brute-force attacks and comes with a known default “admin” user.
See also: Thousands of corporate credentials have been stolen via info-stealing malware
“Mass exploitation will be more difficult since valid credentials are required. However, as I mentioned in the blog, routers lack basic protections against password guessing,” VulnCheck researcher Jacob BainesBleepingComputer.
“We intentionally did not release a proof-of-concept exploit, but if we had, I have no doubt that the exploit would have been successfully used immediately after the blog was released“.
The CVE-2023-30799 vulnerability affecting routers was first disclosed in June 2022, and MikroTik patched the issue in October 2022 for RouterOS stable (v6.49.7) and on July 19, 2023, for RouterOS Long-term (v.86.49.86).
Researchers used Shodan to determine the impact of this critical vulnerability and found that 474,000 devices were vulnerable. However, since this vulnerability can also be exploited through Winbox, a Mikrotek management client, Baines found that 926,000 devices exposed this management port. So things are much more serious.
See also: VMware: Fixes bug that exposes CF API admin credentials in audit logs
CVE-2023-30799
While exploiting this vulnerability requires an existing administrator account , it allows for a higher level of privileges called “Super Admin” .
Unlike an admin account, which offers limited elevated privileges, Super Admin provides full access to the RouteOS operating system.
"By escalating to super admin, the attacker can reach a code path that allows them to control the address of a function call," Baines told BleepingComputer.
Super admin is not a privilege given to regular administrators, it is a privilege that is supposed to be granted to certain parts of the underlying software (specifically, in this case, for loading libraries for the web interface) and not to actual users.
For this reason, this vulnerability is valuable to cybercriminals who wish to “jailbreak” a RouterOS device, to make significant changes to the underlying operating system or to hide their activities.
More details on how researchers were able to develop an exploit for CVE-2023-30799 can be found in the VulnCheck report
See also: Two critical AMI MegaRAC vulnerabilities identified
It is worth noting that MikroTik devices have been targeted by hackers.
Users should take immediate action to patch the critical vulnerability. If you have a MikroTik router, apply the latest update for RouterOS. It is believed that attempts to exploit the vulnerability are expected to increase.
Some basic protection measures include removing administrative interfaces from the Internet, restricting login IP addresses to a specified allow-list, disabling Winbox, using SSH only, and configuring SSH to use public/private keys instead of passwords.
MikroTik routers are popular for providing rich features and flexibility at an affordable price. However, the CVE-2023-30799 vulnerability illustrates the criticality of securing these devices. It is particularly important for users to keep systems updated with the latest software versions and follow security best practices.
Source: www.bleepingcomputer.com
