Mikrotik OS security threat issue?

RouterOS General
1

OK, so spend more than a few hours investigating a few hick ups… In the process I’ve noticed the following:

  • On one of my PPP interfaces i did an ‘export’ command to double check the configs of certain interfaces and I noticed:
/interface pptp-client export
.... password="xxxx\$xxxxx".....

Now, the original password as follows:

/interface pptp-client export
.....password="xxx$xxx"

So, the extra "" appears only during the export command in the terminal and not on the Winbox itself. Question, why is it there?

In the past, as many already know, lots of hacks have happened where OS had some ‘extra’ characters added to certain syntaxes which allowed 3rd party to access to networks device… Whats going on Mik team?

2

The $ needs to be escaped in a string as $ because $var is expanded into “the contents of var”.
Similarly, a " has to be escaped as " or else it will be taken as the end of string mark.

Nothing to see here, move along!