44
MikroTik RouterOS flaw lets attackers run code as root | Cybernews (cybernews.com)
submitted 1 month ago by to c/cybersecurity@sh.itjust.works
5 comments fedilink hide all child comments

all 5 comments

sorted by: hot top controversial new old
[–] -2 points 1 month ago (4 children)

Shame.

My experience with Mikrotik was poor and I don't use or recommend them to anyone, but I still hope to see them continue to improve and be very successful.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 12 points 1 month ago* (last edited 1 month ago) (3 children)

    What was your issue with them? Genuinely curious. My experience has been the opposite.

    Also, in general (not directed to the person I'm replying to) the web management interface being exposed to the Internet, which is where this vulnerability lies, is poor cyber practice. You should NEVER expose a management interface to the Internet.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 1 month ago (2 children)

    You should NEVER expose a management interface to the Internet.

    Yep. That's a "stop hitting yourself" level of easily-preventable abject stupidity.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago* (last edited 1 month ago) (1 child)

    That would be fair if this was something people had to enable consciously.

    In context, I think it’s pretty victim-blamey to assume people should know 1) the default services running on their router are insecure and 2) that the web config interface is exposed publicly OOTB, instead of only to their LAN.

    This is a huge fuckup by Mikrotik, not the users.

    E: Checking the docs, I think I was wrong that it’s enabled publicly OOTB. I tried hitting my own router earlier from public IP and it looked like it was getting through, but maybe the traffic was getting bridged automatically.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 month ago

    Idk, microtiks are pretty prosumer, not at all plug and play. Configuring one is a complex task already, people that have that level of skill should absolutely know not to go doing silly things...

  • permalink
  • fedilink
  • source
  • parent