Lebih dari 900.000 perangkat MikroTik terkena dampak kerentanannya yang menyebabkan eksekusi kode sewenang-wenang, seperti yang dilaporkan oleh penyedia intelijen kerentanan, VulnCheck. Kerentanannya, yang dilacak dengan kode CVE-2023-30799 (dengan skor CVSS 9.1), dijelaskan sebagai bug eskalasi hak istimewa yang mempengaruhi versi RouterOS sebelum 6.49.7 dan versi jangka panjang RouterOS hingga 6.48.6.
“Seorang penyerang dari jarak jauh dan yang terotentikasi dapat meningkatkan hak dari admin menjadi super-admin pada antarmuka Winbox atau HTTP. Penyerang dapat mengeksploitasi kerentan ini untuk menjalankan kode sewenang-wenang pada sistem,” demikian disebutkan dalam sebuah informasi peringatan dari NIST.
Kerentanannya awalnya diungkapkan pada Juni 2022, dalam konferensi REcon, tetapi tidak ada penanda CVE yang ditetapkan untuknya. Pada saat itu juga, kode proof-of-concept (PoC) yang menunjukkan bagaimana sebuah root shell dapat diperoleh pada mesin virtual RouterOS x86 juga diterbitkan.
MikroTik kemudian memperbaiki bug tersebut dalam versi RouterOS stabil 6.49.7 pada bulan Oktober 2022, tanpa memberikan detail lebih lanjut. Pembaruan juga dirilis untuk versi jangka panjang RouterOS.
Menurut VulnCheck, pencarian menggunakan Shodan menunjukkan bahwa ada banyak perangkat yang berpotensi rentan. “Secara keseluruhan, Shodan mengindeks sekitar 500.000 dan 900.000 sistem RouterOS yang rentan terhadap CVE-2023-30799 melalui antarmuka web dan/atau Winbox mereka,” catatan VulnCheck.
Masalah ini, menurut perusahaan tersebut, harus dianggap serius karena cukup mudah untuk mendapatkan kredensial RouterOS dan mengeksploitasi kerentan ini untuk meningkatkan hak dari admin menjadi ‘super-admin’, yang memberikan akses penyerang ke fungsi panggilan sembarang.
Di satu sisi, para penyerang dapat menggunakan kredensial RouterOS default untuk mengompromi perangkat. Di sisi lain, mereka dapat menggunakan berbagai alat untuk melakukan serangan brute-force pada perangkat RouterOS, termasuk alat API, web, dan Winbox (Shodan menunjukkan sekitar 400.000 perangkat yang mengekspos API RouterOS).
baca Juga : Mikrotik RB941-2nD Mini Murah bisa di suplay Power bank
RouterOS dilengkapi
RouterOS dilengkapi dengan pengguna default ‘admin’ yang seringkali tidak dihapus dari perangkat dan yang dilindungi oleh string kosong. Penyerang dapat menargetkan bug ketidakselarasan respons yang terlihat dalam skema otentikasi Winbox untuk mengetahui keberadaan akun default tersebut.
VulnCheck memverifikasi 5.500 dari host yang diidentifikasi melalui Shodan dan menemukan bahwa 60% dari mereka mengandung akun pengguna admin default.
“Barulah pada RouterOS 6.49 (Oktober 2021) RouterOS mulai meminta para administrator untuk memperbarui kata sandi kosong. Bahkan ketika administrator telah menetapkan kata sandi baru, RouterOS tidak memberlakukan batasan apa pun. Para administrator bebas untuk menetapkan kata sandi apa pun yang mereka pilih, tidak peduli seberapa sederhananya,” demikian catatan VulnCheck.
Kerentanannya awalnya tidak terlalu terdeteksi karena eksploit awal hanya ditargetkan pada mesin virtual RouterOS x86. Namun, eksploit yang menargetkan perangkat keras RouterOS juga telah dirilis, sehingga para administrator diimbau untuk segera memperbarui perangkat mereka.
“Di bawah keadaan normal, kami akan mengatakan bahwa mendeteksi eksploitasi adalah langkah awal yang baik untuk melindungi sistem Anda. Sayangnya, mendeteksi hampir tidak mungkin dilakukan. Antarmuka web dan Winbox RouterOS menerapkan skema enkripsi khusus yang tidak dapat dipecahkan atau diperiksa oleh Snort atau Suricata. Setelah seorang penyerang berhasil masuk ke perangkat, mereka dengan mudah dapat membuat diri mereka tidak terlihat oleh antarmuka RouterOS,” catatan VulnCheck.
Real good information can be found on web site. “The greatest mistake is trying to be more agreeable than you can be.” by Walter Bagehot.
I like the valuable information you provide in your articles. I will bookmark your blog and check again here regularly. I am quite sure I’ll learn many new stuff right here! Good luck for the next!
Enjoyed reading through this, very good stuff, appreciate it. “Shared joys make a friend, not shared sufferings.” by Friedrich Wilhelm Nietzsche.
As soon as I noticed this website I went on reddit to share some of the love with them.
Just wanna remark that you have a very nice web site, I like the pattern it actually stands out.
Thanks , I’ve recently been looking for info about this topic for ages and yours is the best I’ve discovered till now. But, what about the conclusion? Are you sure about the source?
I am no longer sure the place you’re getting your information, but good topic. I must spend a while studying more or understanding more. Thank you for excellent information I used to be on the lookout for this information for my mission.
Hiya, I’m really glad I have found this information. Today bloggers publish only about gossips and web and this is actually irritating. A good website with interesting content, this is what I need. Thanks for keeping this website, I’ll be visiting it. Do you do newsletters? Can’t find it.
Hey, you used to write great, but the last several posts have been kinda boringK I miss your tremendous writings. Past several posts are just a little bit out of track! come on!
This web site is really a walk-through for all of the info you wanted about this and didn’t know who to ask. Glimpse here, and you’ll definitely discover it.
My spouse and I stumbled over here by a different web page and thought I might check things out. I like what I see so i am just following you. Look forward to finding out about your web page for a second time.
Great weblog right here! Additionally your site so much up very fast! What web host are you using? Can I get your affiliate hyperlink to your host? I desire my website loaded up as fast as yours lol
Hello! I just would like to give a huge thumbs up for the great info you have here on this post. I will be coming back to your blog for more soon.
Today, I went to the beach front with my kids. I found a sea shell and gave it to my 4 year old daughter and said “You can hear the ocean if you put this to your ear.” She put the shell to her ear and screamed. There was a hermit crab inside and it pinched her ear. She never wants to go back! LoL I know this is totally off topic but I had to tell someone!
Great post. I was checking continuously this blog and I am inspired! Extremely useful information specifically the closing section 🙂 I take care of such information much. I used to be seeking this particular info for a very lengthy time. Thank you and good luck.
Great V I should definitely pronounce, impressed with your web site. I had no trouble navigating through all tabs and related information ended up being truly easy to do to access. I recently found what I hoped for before you know it in the least. Reasonably unusual. Is likely to appreciate it for those who add forums or anything, web site theme . a tones way for your customer to communicate. Excellent task..
Good write-up, I am normal visitor of one’s site, maintain up the excellent operate, and It’s going to be a regular visitor for a long time.
I got what you intend, appreciate it for posting.Woh I am happy to find this website through google. “Spare no expense to make everything as economical as possible.” by Samuel Goldwyn.
I’ll immediately grab your rss feed as I can not find your email subscription link or e-newsletter service. Do you’ve any? Kindly let me know so that I could subscribe. Thanks.
I was just looking for this info for some time. After 6 hours of continuous Googleing, finally I got it in your web site. I wonder what is the lack of Google strategy that don’t rank this type of informative web sites in top of the list. Normally the top sites are full of garbage.
My programmer is trying to persuade me to move to .net from PHP. I have always disliked the idea because of the expenses. But he’s tryiong none the less. I’ve been using Movable-type on numerous websites for about a year and am anxious about switching to another platform. I have heard fantastic things about blogengine.net. Is there a way I can import all my wordpress posts into it? Any kind of help would be really appreciated!
I?¦ve recently started a website, the information you offer on this website has helped me greatly. Thanks for all of your time & work.
Good info. Lucky me I reach on your website by accident, I bookmarked it.
Rattling superb information can be found on web blog.
Aw, this was a very nice post. In thought I would like to put in writing like this additionally – taking time and actual effort to make a very good article… but what can I say… I procrastinate alot and under no circumstances seem to get one thing done.
Way cool, some valid points! I appreciate you making this article available, the rest of the site is also high quality. Have a fun.
I?¦ve been exploring for a little bit for any high-quality articles or blog posts in this sort of house . Exploring in Yahoo I finally stumbled upon this site. Reading this information So i?¦m happy to show that I’ve a very excellent uncanny feeling I found out exactly what I needed. I so much indubitably will make sure to don?¦t disregard this site and provides it a glance on a relentless basis.
Excellent read, I just passed this onto a friend who was doing some research on that. And he just bought me lunch because I found it for him smile Thus let me rephrase that: Thanks for lunch!
You got a very good website, Sword lily I detected it through yahoo.