{"uuid": "8684b946-443e-42db-bc17-7b205f465cf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-30799", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/111592", "content": "Black Hat Ethical Hacking\nSuper Admin Privilege Vulnerability Plagues MikroTik Routers\n\nSuper Admin Privilege Vulnerability Plagues MikroTik RoutersPost Views: 23 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA critical vulnerability dubbed CVE-2023-30799 has put over 900,000 MikroTik RouterOS routers at severe risk, allowing attackers to gain \u201csuper-admin\u201d privileges and take full control of the devices without detection.\n\nDiscovered by renowned Google security researcher Tavis Ormandy, the flaw enables remote attackers with an existing admin account to elevate their privileges through the Winbox or HTTP interface. Although exploitation requires an admin account, the presence of a well-known default \u201cadmin\u201d user in the Mikrotik RouterOS operating system makes this a significant concern.\n\nWhile the vulnerability was initially disclosed without an identifier in June 2022, MikroTik patched the issue in October 2022 for RouterOS stable (v6.49.7) and recently, on July 19, 2023, for RouterOS Long-term (v6.49.8).\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Problem of scaleVulnCheck, a cybersecurity firm, reports that the impact of the flaw is far-reaching, with 474,000 vulnerable devices remotely exposing the web-based management page. However, when accounting for the exploit\u2019s potential over Winbox, a Mikrotek management client, the number of devices exposing this management port balloons to 926,000, making the impact significantly larger.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Devices/versions.jpg Detected RouterOS versions (VulnCheck) CVE-2023-30799CVE-2023-30799 grants attackers \u201cSuper Admin\u201d privileges, offering unrestricted access to the RouterOS operating system. By leveraging this privilege elevation, attackers can manipulate function calls, enabling them to control the underlying software and evade detection.\n\nVulnCheck\u2019s analysts developed an exploit for the flaw using Margin Research\u2019s FOISted remote RouterOS jailbreak exploit, allowing for root shell access on MIPS-based MikroTik devices. This new exploit bypasses FTP interface exposure requirements and remains unaffected by bindshell blocking or filtering, utilizing the RouterOS web interface to upload files.\n\nMikroTik\u2019s default admin user, which is often not removed as recommended, remains a vulnerability point. Additionally, the lack of admin password strengthening requirements exposes users to brute-force attacks, with MikroTik offering no protection except on the SSH interface.\nTrending: Unlocking Windows System Resource Utilization for Digital Forensics Analysis with SRUM Dump Trending: Digital Forensics Tool: ScrapPy Update your MikroTik devicesMikroTik users must take immediate action to patch the flaw by applying the latest RouterOS update. To enhance security, users should remove administrative interfaces from the internet, restrict login IP addresses to an allow-list, disable Winbox in favor of SSH, and configure SSH to use public/private keys instead of passwords. Failure to address the vulnerability could lead to disastrous consequences, as threat actors may attempt to exploit it rapidly.\nTrending: WormGPT: Unleashing the Dark Side of Generative AI for Cybercrime\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.co[...]", "creation_timestamp": "2026-09-04T11:00:05.312543Z"}