{"data":{"case":{"actions":{"de":["Aktualisiere RouterOS mit **Check for updates** auf eine aktuelle Version; alle Versionen von 6.29 bis 6.42 sind für diese Lücke offen, die **6.42.1** und **6.40.8** behoben haben.","Ändere nach dem Update alle Router-Passwörter: Wenn Angreifer die Benutzerdatenbank vorher kopiert haben, sperrt das Update allein sie nicht aus.","Sorge dafür, dass Winbox (Port **8291**) aus dem Internet nicht erreichbar ist: Sperre den Port in der Firewall oder erlaube unter **IP \u003e Services** nur bekannte Adressen.","Prüfe die Konfiguration auf Einstellungen, die du nicht selbst vorgenommen hast: Scheduler-Aufgaben, die Skripte abrufen, einen eingeschalteten **SOCKS-Proxy**, einen laufenden Paket-Sniffer, unbekannte Benutzer oder VPN-Clients."],"en":["Update RouterOS to a current release with **Check for updates**; all versions from 6.29 to 6.42 are open to this flaw, which **6.42.1** and **6.40.8** fixed.","Change every router password after the update: if attackers copied the user database earlier, the update alone does not lock them out.","Do not let Winbox (port **8291**) be reached from the internet: block it in the firewall, or allow only known addresses under **IP \u003e Services**.","Check the configuration for settings you did not make: scheduler tasks that fetch scripts, an enabled **SOCKS proxy**, a running packet sniffer, unknown users or VPN clients."]},"criteria":{"damage":{"de":"Eine Zahl zum Schaden ist nicht dokumentiert. Laut MikroTik nutzte das Botnetz Mēris, das Yandex 2021 mit 21,8 Millionen Anfragen pro Sekunde überflutete, 2018 kompromittierte Router; die Quellen nennen aber weder Kosten noch Ausfälle kritischer Dienste (Qrator Labs, MikroTik).","en":"No damage figure is documented. MikroTik says the Mēris botnet, which flooded Yandex with 21.8 million requests per second in 2021, used routers compromised in 2018, but the sources give no cost and no outage of critical services (Qrator Labs, MikroTik).","met":false},"exploitation":{"de":"Angreifer hatten auf 239.000 Geräten einen Proxy eingeschaltet und 7.500 Router dazu gebracht, den Datenverkehr ihrer Besitzer an sie weiterzuleiten (Netlab 360, 4. September 2018); mehr als 170.000 Geräte trugen denselben Coinhive-Mining-Schlüssel (Trustwave, 2018).","en":"Attackers had switched on a proxy on 239,000 devices and made 7,500 routers send their owners' traffic to them (Netlab 360, September 4, 2018); more than 170,000 devices carried the same Coinhive mining key (Trustwave, 2018).","met":true},"reach":{"de":"Am 23. und 24. August 2018, vier Monate nach dem Patch, waren noch 370.000 MikroTik-Geräte verwundbar, 30,83 % der 1,2 Millionen Geräte, deren Winbox aus dem Internet erreichbar war (Netlab 360).","en":"370,000 MikroTik devices, 30.83 % of the 1.2 million found with Winbox open to the internet, were still vulnerable on August 23–24, 2018, four months after the fix (Netlab 360).","met":true},"response":{"de":"Der Patch von MikroTik, wiederholte Aufrufe, Passwörter zu ändern, und im Dezember 2021 ein Eintrag in der CISA-Liste ausgenutzter Schwachstellen; eine Notfallanweisung oder die höchste nationale Warnstufe sind nicht dokumentiert (MikroTik, CISA).","en":"MikroTik's fix and repeated calls to change passwords, and an entry on CISA's list of exploited vulnerabilities in December 2021, but no emergency directive or highest national warning level is documented (MikroTik, CISA).","met":false}},"cves":["CVE-2018-14847"],"cvss":9.1,"cvss_version":"3.1","cwe":"CWE-22","dates":[{"date":"2018-04-23","key":"discovered"},{"date":"2018-04-23","key":"patched"},{"date":"2018-07-31","de":"Trustwave bemerkt eine Welle von Mining-Skripten, die MikroTik-Router in Brasilien ausliefern","en":"Trustwave notices a surge of mining scripts served by MikroTik routers in Brazil"},{"date":"2018-09-04","de":"Netlab 360 meldet 7.500 Router, die den Datenverkehr ihrer Besitzer an Angreifer weiterleiten","en":"Netlab 360 reports 7,500 routers that send their owners' traffic to attackers"},{"date":"2018-10-10","de":"Tenable zeigt, dass die Lücke Angreifern auch eine Root-Shell verschaffen kann","en":"Tenable shows that the flaw can also give attackers a root shell"},{"date":"2021-09-15","de":"Laut MikroTik nutzt das Botnetz Mēris für seine DDoS-Rekordangriffe Router, die 2018 kompromittiert wurden","en":"MikroTik says the Mēris botnet, behind record DDoS attacks, uses routers compromised in 2018"},{"date":"2021-12-01","key":"kev"}],"de":{"credit":"MikroTik selbst, nach eigenen Angaben; ein externer Entdecker wird nicht genannt","fixed":"RouterOS 6.42.1, 6.40.8 und 6.43rc4 (23. April 2018)","product":"MikroTik RouterOS, das Betriebssystem der MikroTik-Router, über seinen Verwaltungsdienst Winbox","summary":"Eine Lücke im Winbox-Dienst von MikroTik-Routern ließ jeden die Passwörter der Administratoren herunterladen; Monate nach dem Patch hatten Angreifer mehr als 200.000 Router gekapert."},"disclosed":"2018-04-23","en":{"credit":"MikroTik itself, by its own account; no outside finder is named","fixed":"RouterOS 6.42.1, 6.40.8 and 6.43rc4 (April 23, 2018)","product":"MikroTik RouterOS, the operating system of MikroTik routers, through its Winbox management service","summary":"A flaw in the Winbox service of MikroTik routers let anyone download the administrators' passwords; months after the fix, attackers had hijacked more than 200,000 routers."},"figures":[{"de":"MikroTik-Geräte waren vier Monate nach dem Patch noch verwundbar (Netlab 360)","en":"MikroTik devices were still vulnerable four months after the fix (Netlab 360)","value":"370,000"},{"de":"Geräte betrieben einen Proxy, den Angreifer eingeschaltet hatten (gezählt nach IP-Adressen; Netlab 360)","en":"devices ran a proxy that attackers had switched on (counted by IP address; Netlab 360)","value":"239,000"},{"de":"Router schickten Kopien des Datenverkehrs ihrer Besitzer an Angreifer (Netlab 360)","en":"routers sent copies of their owners' traffic to attackers (Netlab 360)","value":"7,500"},{"de":"MikroTik-Geräte trugen denselben Coinhive-Mining-Schlüssel (mehr als; Trustwave, über Censys)","en":"MikroTik devices carried the same Coinhive mining key (more than; Trustwave, via Censys)","value":"170,000"}],"kev":"2021-12-01","key":"mikrotik","name":"MikroTik Winbox","product":"MikroTik RouterOS","sources":[{"de":"MikroTik-Sicherheitshinweis: Winbox-Schwachstelle (CVE-2018-14847)","title":"MikroTik security advisory: Winbox vulnerability (CVE-2018-14847)","url":"https://mikrotik.com/supportsec/winbox-vulnerability/"},{"de":"MikroTik-Forum: Warnung vom 23. April 2018, mit den korrigierten Versionen","title":"MikroTik forum: advisory of April 23, 2018, with the fixed versions","url":"https://forum.mikrotik.com/t/advisory-vulnerability-exploiting-the-winbox-port-solved/118771"},{"de":"MikroTik-Forum: Ein Botnetz nutzt die Winbox-Lücke aus (2. August 2018)","title":"MikroTik forum: a botnet exploits the Winbox flaw (August 2, 2018)","url":"https://forum.mikrotik.com/t/winbox-vulnerability-please-upgrade/122004"},{"de":"MikroTik: Stellungnahme zum Botnetz Mēris (15. September 2021)","title":"MikroTik: statement on the Mēris botnet (September 15, 2021)","url":"https://mikrotik.com/supportsec/meris-botnet/"},{"de":"NVD: CVE-2018-14847","title":"NVD: CVE-2018-14847","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14847"},{"de":"CISA: Katalog ausgenutzter Schwachstellen, Eintrag zu CVE-2018-14847","title":"CISA: Known Exploited Vulnerabilities Catalog, entry for CVE-2018-14847","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847"},{"de":"Netlab 360: Mehr als 7.500 MikroTik-Router leiten den Datenverkehr ihrer Besitzer an Angreifer weiter (4. September 2018)","title":"Netlab 360: 7,500+ MikroTik routers are forwarding owners' traffic to the attackers (September 4, 2018)","url":"https://blog.netlab.360.com/7500-mikrotik-routers-are-forwarding-owners-traffic-to-the-attackers-how-is-yours-en/"},{"de":"Trustwave SpiderLabs: Masseninfektion von MikroTik-Routern, zuerst in Brasilien (2018, heute auf der Website von LevelBlue)","title":"Trustwave SpiderLabs: mass MikroTik router infection, first in Brazil (2018, now on the LevelBlue site)","url":"https://www.levelblue.com/en-us/resources/blogs/spiderlabs-blog/mass-mikrotik-router-infection-first-we-cryptojack-brazil-then-we-take-the-world/"},{"de":"Tenable: Sicherheitslücken in MikroTik RouterOS, hinter CVE-2018-14847 steckt mehr (10. Oktober 2018)","title":"Tenable: MikroTik RouterOS vulnerabilities, there's more to CVE-2018-14847 (October 10, 2018)","url":"https://www.tenable.com/blog/mikrotik-routeros-vulnerabilities-there-s-more-to-cve-2018-14847"},{"de":"Qrator Labs und Yandex: Das Botnetz Mēris auf Rekordkurs (9. September 2021)","title":"Qrator Labs and Yandex: Mēris botnet, climbing to the record (September 9, 2021)","url":"https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/"},{"de":"Microsoft: TrickBot nutzt MikroTik-Router, um seine Steuerserver zu verbergen (16. März 2022)","title":"Microsoft: TrickBot's use of MikroTik routers to hide its command servers (March 16, 2022)","url":"https://www.microsoft.com/en-us/security/blog/2022/03/16/uncovering-trickbots-use-of-iot-devices-in-command-and-control-infrastructure/"},{"de":"Cisco Talos: VPNFilter III, mit dem Winbox-Protokoll von MikroTik (26. September 2018)","title":"Cisco Talos: VPNFilter III, with MikroTik's Winbox protocol (September 26, 2018)","url":"https://blog.talosintelligence.com/vpnfilter-part-3"},{"de":"BleepingComputer (Presse): MikroTik schließt eine bereits angegriffene Zero-Day-Lücke in Rekordzeit (24. April 2018)","title":"BleepingComputer (press): MikroTik patches zero-day flaw under attack in record time (April 24, 2018)","url":"https://www.bleepingcomputer.com/news/security/mikrotik-patches-zero-day-flaw-under-attack-in-record-time"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","year":2018}},"description":"A 2018 flaw let attackers copy the passwords of MikroTik routers. Four months after the fix, 370,000 were still open and over 200,000 had been hijacked.","language":"en","latest_measurement":"2026-11-01","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On April 23, 2018, the router maker MikroTik fixed a flaw in RouterOS, the operating system of its routers. Through Winbox, the service for managing a router remotely, anyone on the internet could download the router\u0026rsquo;s user database, with the names and passwords of its administrators, without logging in. Four months after the fix, the Chinese security lab Netlab 360 still counted about 370,000 vulnerable MikroTik devices. By then, attackers had taken over more than 200,000 MikroTik devices to hide their own traffic, to spy on owners and to mine cryptocurrency.\nHow it worked Winbox is a small Windows program that administrators use to configure MikroTik routers. It talks to a matching service on the router through network port 8291. A port is a numbered entry point through which a device offers a service. MikroTik stresses that the fault lay in this service in RouterOS itself, not in the Windows program.\nThe service did not check the file paths in incoming requests properly. A crafted path could step out of the folder the service was meant to use, a mistake known as path traversal. An attacker could ask for any file without logging in, including the user database. That file held the administrators\u0026rsquo; names and passwords, and the passwords could be decoded: MikroTik promised to harden the database so that “deciphering will no longer be possible in the same manner.”\nWith the password, an attacker could log in like a normal administrator and change any setting. MikroTik\u0026rsquo;s advisory describes one possible trace: a failed login in the log, followed by a successful one from an unknown address. Beyond that, there was “no sure way” to tell whether a router had been attacked.\nIn October 2018, the security firm Tenable showed that the flaw was worse than thought: the same kind of request could also write files anywhere on the router. Tenable used this to create a file that switches on a root shell, a command line with full control over the system beneath RouterOS, and stated that an attacker without a password could reach it.\nAttackersends a crafted request to port 8291 Winbox serviceaccepts a path outside its folder User databasehands over names and passwords Attackerlogs in as administrator and changes settings No login is needed for the first three steps. An update closes the hole, but stolen passwords stay valid until they are changed. Reach and damage The best count comes from Netlab 360. On August 23 and 24, 2018, the lab scanned the internet: more than 5 million devices had port 8291 open, 1.2 million of them were MikroTik devices, and 370,000 of those, 30.83 %, were still vulnerable.\nAttackers had found many of them first. Netlab counted 239,000 devices, by internet address, on which attackers had switched on a SOCKS4 proxy, a relay through which they could send their own traffic so that it seemed to come from the router. On 7,500 routers, the attackers had turned on the built-in traffic capture and sent copies of the owners\u0026rsquo; traffic to their own servers. They were most interested in the ports used for email and file transfers. The largest numbers of these spied-on routers were in Russia (1,628), Iran (637) and Brazil (615).\nMikroTik devices with Winbox open to the internet, August 23–24, 2018 Found1,200,000 Still vulnerable370,000 Running a proxy switched on by attackers239,000 Sending traffic to attackers7,500 Counted by internet address. Source: Netlab 360 (2018).\nOthers wanted money. On July 31, 2018, the security firm Trustwave noticed a sudden surge in Brazil of Coinhive, a script that uses the computers of website visitors to mine a cryptocurrency. The pages came from MikroTik routers: the attackers had used the router\u0026rsquo;s web proxy, a function that relays web requests, to serve error pages with the script. Shodan, a search engine for devices on the internet, listed more than 70,000 such devices in Brazil, all with the same Coinhive key, so they all mined for one account. A similar search engine, Censys, found more than 170,000 MikroTik devices with that key.\nMany routers stayed in attackers\u0026rsquo; hands for years. In September 2021, Qrator Labs, a firm that defends websites against DDoS attacks, and the Russian internet company Yandex described a new botnet called Mēris. A botnet is a network of hijacked devices; in a DDoS attack, they flood a service with requests until it fails. On September 5, 2021, Mēris hit Yandex with 21.8 million requests per second, the largest such attack in internet history up to then, according to the researchers. The devices seemed to come from a single manufacturer, MikroTik, and the botnet\u0026rsquo;s internals pointed to 250,000 infected devices. MikroTik stated that there was no new vulnerability and that, as far as it had seen, “these attacks use the same routers that were compromised in 2018.”\nRequests per second in the Mēris attacks on Yandex, 2021 August 75.2 million August 96.5 million August 299.6 million August 3110.9 million September 521.8 million MikroTik says that the botnet used routers compromised in 2018. Source: Qrator Labs and Yandex (2021).\nIn March 2022, Microsoft reported that the criminals behind the TrickBot malware used hacked MikroTik routers to hide their command servers; one way in was this flaw, on routers with old versions. VPNFilter, malware that Cisco Talos found on hundreds of thousands of network devices in 2018, also heavily targeted MikroTik devices, especially in Ukraine. Talos named this flaw as one possible way in, but had no definitive proof.\nNo source puts a figure on the damage. What the eavesdroppers collected, and what the attacks from hijacked routers cost their victims, is unknown.\nThe fix and the response MikroTik writes that it discovered and fixed the flaw on April 23, 2018. It released RouterOS 6.42.1 for the current branch, 6.40.8 for the bugfix branch and 6.43rc4 for test versions; all versions from 6.29 to 6.42 were affected. According to press reports, users of a Czech technology forum had noticed break-ins shortly before, and MikroTik needed less than a day from their reports to the fix. The flaw\u0026rsquo;s public ID, CVE-2018-14847, was only published on August 2, 2018.\nThe update closed the hole but did not undo what attackers had already taken. MikroTik told owners to change their passwords after the update, to block the Winbox port from the internet, and to check the configuration for settings they did not recognize, such as a SOCKS proxy or unknown scripts. In August 2018, when a botnet was attacking routers through the flaw, MikroTik pointed out that the fix had been out since April. In 2021 it repeated: “If somebody got your password in 2018, just an upgrade will not help.”\nThe National Vulnerability Database rates the flaw 9.1 out of 10 on CVSS 3.1, “critical”: an attacker needs no password and can read and change data, but the flaw itself does not shut down the router. On December 1, 2021, the US cyber agency CISA added it to its catalog of vulnerabilities known to be exploited; US federal agencies had to fix it by June 1, 2022. The sources document no emergency directive and no highest national warning level.","title":"MikroTik Winbox: the flaw that gave away router passwords","url":"https://crackthe.net/vulnerabilities/mikrotik/"}