Privilege Escalation Vulnerability in MikroTik RouterOS

What changed

MikroTik RouterOS has been identified with a significant vulnerability related to improper neutralization of argument delimiters in its command handling. This flaw specifically affects the SSH login process, where usernames starting with certain prohibited characters can manipulate the RouterOS policy mask, leading to unauthorized privilege escalation.

The issue was addressed in the following versions: 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

Who is affected

Organizations utilizing MikroTik RouterOS are at risk, particularly those with SSH access configured. The vulnerability can be exploited by unauthenticated users, making it critical for all users to assess their exposure.

Affected products include various versions of MikroTik RouterOS, particularly those prior to the patched releases.

• MikroTik RouterOS versions prior to 6.49.21, 7.23.4, and 7.24.2
• Organizations relying on MikroTik for network infrastructure
• Network administrators managing MikroTik devices

What to do

It is imperative for users of MikroTik RouterOS to upgrade to the latest versions to mitigate the risk associated with this vulnerability. Regularly reviewing and updating network device firmware is a best practice to ensure security.

Additionally, organizations should monitor their SSH access configurations and consider implementing additional security measures such as limiting SSH access to trusted IPs.

• Upgrade RouterOS to version 6.49.21, 7.23.4, or 7.24.2 or later
• Review SSH access settings and restrict access as necessary
• Implement network monitoring to detect unauthorized access attempts