Last modified: DecemWe are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts. If there is any error in this alert or you wish a comprehensive analysis, let us know. MikroTik RouterOS Multiple Vulnerabilities Jacob Baines (Tenable Research) Reference(s) If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled. And router access from the console will also be disabled. When this feature is activated, some functions cannot be performed as by default, namely the reset button and pin-hole reset. RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package’s name field. In Mikrotik there is a feature that serves to protect access to the router system, especially with regard to the use of the reset button. MikroTik RouterOS long-term version 6.44.6 Proof of concept MikroTik RouterOS long-term versions before 6.44.6 Fixed version(s) MikroTik RouterOS stable versions before 6.45.7 Relative Path Traversal in NPK Parsing Vendor(s)

Mikrotik routeros exploits