Overview
This report discusses the critical security vulnerability, CVE-2024-54952, that affects the SMB service in MikroTik RouterOS 6.40.5. This vulnerability, if exploited, can lead to a Remote Denial of Service (DoS), causing the SMB service to become unavailable, potentially leading to system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2024-54952
Severity: Critical (CVSS: 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Remote Denial of Service (DoS), potential system compromise, and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
MikroTik RouterOS | 6.40.5
How the Exploit Works
An unauthenticated attacker can exploit this vulnerability by sending specially crafted packets to the SMB service in MikroTik RouterOS. These packets trigger a null pointer dereference, which leads to a memory corruption and subsequent DoS condition, making the SMB service unavailable.
Conceptual Example Code
The conceptual example below demonstrates how an attacker might craft a malicious packet to exploit this vulnerability:
POST /SMB/service HTTP/1.1
Host: target.mikrotik.com
Content-Type: application/x-smb
{ "malicious_packet": "NULL_POINTER_DEREFERENCE_TRIGGER" }Upon receiving this packet, the SMB service would trigger a null pointer dereference, leading to memory corruption and a subsequent DoS condition.
Mitigation
To mitigate this vulnerability, users are advised to apply the patch provided by the vendor. As a temporary measure, users can also implement a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and filter incoming packets to the SMB service.
