43
MikroTik RouterOS flaw lets attackers run code as root | Cybernews (cybernews.com)
submitted 2 days ago by [M] to c/cybersecurity@sh.itjust.works
8 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 2 days ago (5 children)

You should NEVER expose a management interface to the Internet.

Yep. That's a "stop hitting yourself" level of easily-preventable abject stupidity.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 0 points 2 days ago* (last edited 2 days ago) (4 children)

    That would be fair if this was something people had to enable consciously.

    In context, I think it’s pretty victim-blamey to assume people should know 1) the default services running on their router are insecure and 2) that the web config interface is exposed publicly OOTB, instead of only to their LAN.

    This is a huge fuckup by Mikrotik, not the users.

    E: Checking the docs, I think I was wrong that it’s enabled publicly OOTB. I tried hitting my own router earlier from public IP and it looked like it was getting through, but maybe the traffic was getting bridged automatically.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 2 days ago (2 children)

    Yeah no, the same was said about the previous vulnerability in the SSH server. News stories just assume when people run an unpatched version they are vulnerable from attacks from the internet and run with those numbers. It makes for a better story, but it isn't the whole truth. OOTB these kinds of things aren't exposed to the outside world and exposing them isn't trivial.

    People should still patch and these vulnerabilities aren't a good thing obviously, but the news stories have been pretty sensational for something that probably won't impact a lot of users.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 days ago (1 child)

    Wasn't going off the article: I saw the SSH stuff last month and had double-checked I had all remote-access off on my config.

    Then when I saw the latest story this morning, I ran an nmap that showed webfig was still exposed on my pub IP. Probably just due to some automatic bridging behavior that bit me, but I'll have to confirm later.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 days ago

    Idk, microtiks are pretty prosumer, not at all plug and play. Configuring one is a complex task already, people that have that level of skill should absolutely know not to go doing silly things...

  • permalink
  • fedilink
  • source
  • parent