MikroTik在2026年9月3日发布的RouterOS 7.23.4、7.24.2和6.49.21版本中修复了三个关键安全漏洞，研究人员通过逆向工程这些补丁版本成功复现并分析了这些漏洞的具体细节1。其中一个漏洞允许攻击者通过特殊用户名"-2"利用SSH登录，该用户名可通过文件描述符2读取伪终端数据，进而将经过认证的只读会话提升为完全管理权限1。补丁通过新增validLoginParamInput函数拒绝以"-"或空格开头的用户名来修复此问题1。
第二个漏洞涉及RSA e=3签名伪造，允许已授权的RSA e=3公钥持有者无需私钥即可通过立方根计算构造伪造签名进行认证1。第三个漏洞存在于mtget工具的TFTP请求处理中，未检查缓冲区容量，经过认证的用户可通过/tool fetch命令在路径名偏移541字节处注入700字节有效负载，造成栈溢出并执行任意ROP代码1。补丁添加了TFTP路径长度检查和"Filename too long"错误提示1。
这三个漏洞形成了复杂的攻击链条。研究证实其行为特征与已知的RouterOS攻击活动相符，包括创建ops用户、scheduler条目包含fetch/import命令、与特定恶意域名关联以及异常启用/ip socks服务1。
Security researchers have reverse-engineered three critical vulnerabilities that MikroTik patched in RouterOS versions 7.23.4, 7.24.2, and 6.49.21 released on September 3, 2026 1. The analysis reveals that the company addressed severe flaws affecting SSH authentication, RSA signature verification, and the mtget tool 1.
The first vulnerability exploits SSH username handling through a specially crafted username "-2" that reads pseudoterminal data via file descriptor 2, allowing authenticated users with read-only session privileges to escalate to full administrative access with a PolicyMask value of 0x9fe6e 1. The second flaw involves RSA signature forgery affecting 2048-bit keys with exponent e=3, where attackers holding an authorized RSA public key can craft valid signatures through cube root computation without requiring the private key 1. The third vulnerability exists in mtget's TFTP request processing, which fails to validate buffer capacity when handling path names at an offset of 541 bytes, permitting authenticated users to inject 700-byte payloads via the /tool fetch command that trigger stack overflow and enable return-oriented programming (ROP) attacks 1.
Researchers confirmed that exploitation chains discovered in active RouterOS attack campaigns align with these vulnerabilities, including indicators such as creation of "ops" user accounts, scheduler entries containing fetch or import commands, and communication with domains including mythtime.xyz, leappoach.info, and eeongous.com 1. MikroTik's patches added input validation to reject usernames beginning with hyphens or spaces, corrected RSA verification byte-checking logic, and implemented TFTP path length restrictions with "Filename too long" error handling 1.
评论
还没有评论，欢迎留下第一条。