And you (Mikrotik) need to let your customers out of the dark what is going on and provide more details. Having us in the dark is just plain wrong and helps no one.
Is this a Zeroday (people already exploiting this) what admin port does this relate to? What is the best mitigation?
I do get that this does not exclude us admins protecting admin plane. Anyone who does not is looking for problems but still give us more details so we can properly risk assess the issue. You are only hindering us by not telling us the full picture because the people who wants to exploit this push your code trough and Ai and finds the issue and how to exploit in a few hours so they know already.
I use a cAP AX as a router running version 7.24.1. I upgraded to 7.24.2, but the remote desktop connection to my home PC and the Winbox connection to the router kept dropping every minute over B2H.
I tried restarting the WireGuard VPN client (on Windows), but that didn't help; it reconnected, but the connection remained unstable. The RouterOS logs showed nothing unusual other than the Winbox login entries caused by the winbox disconnections. I pinged 1.1.1.1 from the PC behind router, there was no loss, no high latency.
I reverted to version 7.24.1, and the connection stabilized again.
IDK what is happening, but every time I try to set RSTP Priority IN WINBOX - it always sets back to 0x8000 - no matter whether I choose higher or lower.
I was able to force with Terminal - however syntax has changed since last i ran a script (used to just use "priority=1000" - but had to use priority=0x1000 - unsure if this was intended - or noted)
I think you are missing my point. They already are. The "bad" people who want to exploit this have already done a diff in the code, seen what you have done and have already workning exploits either ready or soon to be ready.
Look at all other big vendors who already do this. I do not mean you need to give me complete exploit code I just want to know more details where and if you think not giving this details will protect us you are dead wrong it only huts us.
All I'm asking is for is a little more details for exmaple: This is an important security update realted to admin interfaces, router management, for your equipment. We strongly advice you to patch this exploit as soon as possble or ensure that no admin interface is publicy avaliable. More details on this security issue will be published at a later date.
This is all I'm asking for. Instead I have to read trough forums or reddit to get this information.
Edit: I know I complain a lot on this but I only do this as I want to see you do great. You are the only vendor that is not going the monthly/yearly subscription route and I love you for it so I want you to win. I'm only hard on you because I like you
"admin port" is any TCP port open to the router management systems, like Winbox, Webfig, SSH, API etc.
The TCP ports are:
Columns: NAME, PORT, PROTO, ADDRESS, CERTIFICATE, VRF, MAX-SESSIONS
# NAME PORT PROTO ADDRESS CERTIFICATE VRF MAX-SESSIONS
0 ftp 21 tcp main 20
1 ssh 22 tcp main 20
2 telnet 23 tcp main 20
7 www 80 tcp main 20
9 X www-ssl 443 tcp none main 20
13 winbox 8291 tcp main 20
15 api 8728 tcp main 20
16 api-ssl 8729 tcp none main 20```
The only thing you’re doing here is giving bad actors the patches to diff and reveal the vulnerabilities themselves, while concealing crucial information from those trying to asses the situation and defend themselves - essentially giving bad actors the upper hand.
You don’t need to release technical information about the vulnerability, nor the exploit - but saying it affects A, B, and C services, the outcome, and the fact it is exploited in the wild is the minimal responsible thing to do here.
You need to honor your customers just as much as you expect security researchers to honor responsible disclosure - when this trust breaks, the latter may eventually decide to take it on themselves and drop public POCs to force you to comply. This happened more times than you can imagine, and while it causes temporary chaos, the pressure it creates works wonders.
And I’m saying this with the best intentions possible. Security by obscurity never works, it only provides a false sense of security.
CVE will be published when information becomes available. Other vendors have a similar practice, if systems are at risk, CVE will be only a placeholder until it is safe to reveal more details.
I'm not asking for a CVE, but it would be nice, I want to do a risk assesment and need info to do this so I want to understand what componets are affected.
All I can reveal in this moment is that administrative access ports should be protected from untrusted networks (internet), and segmented in separate VLAN in large internal networks. Do not expose Winbox, Webfig, SSH to internet, use a firewall and access your device with a strong VPN like Wireguard.
If this situation is as serious as I think it is, then this is perfectly adequate information to take action on one's internet-exposed routers.
I think the MikroTik team is not withholding specific information lightly, and that they have everyone's best interests in mind. Let's not forget that this is a stressful time for everyone at MikroTik as well!
