Test ID:	1.3.6.1.4.1.25623.1.0.813155
Category:	General
Title:	Mikrotik RouterOS 'Winbox Service' Information Disclosure Vulnerability (Apr 2018) - Version Check
Summary:	Mikrotik RouterOS is prone to an information disclosure; vulnerability.
Description:	Summary: Mikrotik RouterOS is prone to an information disclosure vulnerability. Vulnerability Insight: The flaw exists due to an error in the winbox service of routeros which allows remote users to download a user database file without successful authentication. Vulnerability Impact: Successful exploitation will allow a remote attacker to connect to the WinBox port and download a user database file. The remote user can then log in and take control of the router. Affected Software/OS: MikroTik Router OS versions 6.29 through 6.42, 6.43rcx prior to 6.43rc4. Solution: Update to version 6.42.1, 6.43rc4 or later. CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-14847 https://www.exploit-db.com/exploits/45578/ https://github.com/BasuCert/WinboxPoC https://github.com/BigNerd95/WinboxExploit https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf https://github.com/tenable/routeros/tree/master/poc/bytheway https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847 https://n0p.me/winbox-bug-dissection/
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.