Hacker News Reader

Comment by jlgaddis | Hacker News Reader

Mikrotik devices were reportedly affected as well, although I haven't seen any specific model identified (they all run pretty much the same software, although various models are based on different CPU architectures).

View on HN

I've read three articles about this today (this one included), and they all specified the same Mikrotik models:

- Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072

You're right, I just got down to the bottom of the article and those models are listed there.

I don't recall what article I read a day or two ago, but I don't believe it mentioned the specific models.

As GP says, MT boxes all run the same software. The latest release (6.42.3) dated May 24 has suspiciously few bugfixes listed in the changelog. Probably worth updating on the basis the vulnerability fix is in there too.

The original Cisco article mentions that these aren't all of the vulnerable models, just the ones they've seen. There isn't anything fundamentally different between a 1009 and a 1016.

Using a vulnerability fixed last March.

damn, enterprise I used to work at uses mikrotik for critical services...

So critical that they'd leave the web interface running on public IPs without firewalling? If not then they're probably safe.

Is it known that the vulnerability is in the web UI? I ask because the CERT report advised to disable/ACL web UI but it didn't (afaik) say that this was the attach vector. They might have just thrown that in as sound general advice.

From their official forum post[1]:

"Your devices are safe if the port 80 is firewalled, or if you have upgraded to v6.38.5 or newer."

[1] https://forum.mikrotik.com/viewtopic.php?f=21&t=132499

Reply on news.ycombinator.com