CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 3CVE-2020-13118 – Mikrotik Router Monitoring System 1.2.3 - 'community' SQL Injection
https://notcve.org/view.php?id=CVE-2020-13118
An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community.php via the parameter community. Se detectó un problema en Mikrotik-Router-Monitoring-System hasta el 22-10-2018. Una Inyección SQL se persenta en el archivo check_community.php por medio del parámetro community. Mikrotik Router Monitoring System versions 1.2.3 and below suffer from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/48474 http://packetstormsecurity.com/files/157733/Mikrotik-Router-Monitoring-System-1.2.3-SQL-Injection.html https://github.com/adeoluwa-adebiyi/Mikrotik-Router-Monitoring-System/issues/4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 2CVE-2018-10070 – MikroTik 6.41.4 - FTP daemon Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2018-10070
A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM by sending a crafted FTP request on port 21 that begins with many '\0' characters, preventing the affected router from accepting new FTP connections. The router will reboot after 10 minutes, logging a "router was rebooted without proper shutdown" message. Una vulnerabilidad en MikroTik, versión 6.41.4, podría permitir que un atacante remoto no autenticado agote la CPU y toda la RAM disponible mediante el envío de una petición FTP en el puerto 21 que comienza por muchos caracteres "\0", lo que evita que el router afectado acepte nuevas conexiones FTP. El router se reiniciará tras 10 minutos, mostrando un mensaje de "router was rebooted without proper shutdown". • https://www.exploit-db.com/exploits/44450 http://packetstormsecurity.com/files/147183/MikroTik-6.41.4-Denial-Of-Service.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 3%CPEs: 2EXPL: 1CVE-2017-17538 – MikroTik 6.40.5 ICMP - Denial of Service
https://notcve.org/view.php?id=CVE-2017-17538
MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets. Los dispositivos MikroTik v6.40.5 permite que atacantes remotos provoquen una denegación de servicio mediante una inundación de paquetes ICMP. • https://www.exploit-db.com/exploits/43317 •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 4CVE-2017-6444 – MikroTik Router - ARP Table OverFlow Denial Of Service
https://notcve.org/view.php?id=CVE-2017-6444
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many ACK packets. After the attacker stops the exploit, the CPU usage is 100% and the router requires a reboot for normal operation. El router MikroTik hAP Lite 6.25 no tiene mecanismo de protección para paquetes TCP ACK no solicitados en el caso de una conexión de red rápida. lo que permite a atacantes remotos provocar una denegación de servicio (consumo de CPU) enviando muchos paquetes ACK. Después de que el atacante detenga el exploit, el uso de CPU es 100% y el router requiere un reinicio para un funcionamiento normal • https://www.exploit-db.com/exploits/41601 http://www.exploitalert.com/view-details.html?id=26137 https://cxsecurity.com/issue/WLB-2017030029 https://packetstormsecurity.com/files/141449/Mikrotik-Hap-Lite-6.25-Denial-Of-Service.html • CWE-400: Uncontrolled Resource Consumption •