A vulnerability classified as critical was found in RouterOS up to 6.44.5/6.45.6 (Router Operating System). Affected by this vulnerability is some unknown functionality of the component DNS Handler. The manipulation with an unknown input leads to a missing authentication vulnerability (Cache Poisoning). The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning

The weakness was presented 10/29/2019. This vulnerability is known as CVE-2019-3978. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at packetstormsecurity.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47566). See VDB-144434, VDB-144432 and VDB-144431 for similar entries.

Productinfo

Type

• Router Operating System

Name

• RouterOS

Version

• 6.44.0
• 6.44.1
• 6.44.2
• 6.44.3
• 6.44.4
• 6.44.5
• 6.45.0
• 6.45.1
• 6.45.2
• 6.45.3
• 6.45.4
• 6.45.5
• 6.45.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion