CVE-2020-11881: MikroTik RouterOS DoS Vulnerability

CVE-2020-11881 Overview

CVE-2020-11881 is an array index error vulnerability affecting MikroTik RouterOS versions 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5. This vulnerability allows an unauthenticated remote attacker to crash the SMB server by sending specially crafted setup-request packets, resulting in a denial of service condition. The vulnerability is tracked internally by MikroTik as SUP-12964.

Critical Impact

Unauthenticated remote attackers can crash the SMB server on affected MikroTik RouterOS devices, disrupting file sharing services and potentially impacting network operations.

Affected Products

• MikroTik RouterOS versions 6.41.3 through 6.46.5
• MikroTik RouterOS 7.0 Beta3
• MikroTik RouterOS 7.0 Beta4
• MikroTik RouterOS 7.0 Beta5

Discovery Timeline

• 2020-09-14 - CVE-2020-11881 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-11881

Vulnerability Analysis

This vulnerability stems from improper validation of array indices within the SMB server component of MikroTik RouterOS. When processing SMB setup-request packets, the server fails to properly validate index values before accessing array elements. This improper input validation (CWE-129: Improper Validation of Array Index) allows attackers to reference memory locations outside the intended array boundaries, leading to a crash of the SMB service.

The attack can be executed remotely over the network without requiring any authentication or user interaction. The impact is limited to availability—confidentiality and integrity of the system remain unaffected. However, repeated exploitation could result in sustained denial of service against the SMB file sharing functionality.

Root Cause

The root cause is classified as CWE-129: Improper Validation of Array Index. The SMB server implementation in RouterOS does not adequately verify that array index values received in setup-request packets fall within valid bounds before using them to access array elements. This oversight allows malformed packets to trigger out-of-bounds memory access, resulting in application termination.

Attack Vector

The attack is executed remotely over the network by sending modified SMB setup-request packets to the vulnerable RouterOS device. The attacker does not need any credentials or prior access to the system. By manipulating specific fields in the SMB setup-request packet structure, an attacker can cause the SMB server to reference invalid array indices, triggering a crash.

A proof-of-concept demonstrating this vulnerability is available in the botlabsDev GitHub repository. Security researchers should reference this repository for detailed technical information on packet structure manipulation required to trigger the vulnerability.

Detection Methods for CVE-2020-11881

Indicators of Compromise

• Unexpected SMB service crashes or restarts on MikroTik RouterOS devices
• High volume of malformed SMB connection attempts from external IP addresses
• System logs showing SMB service failures or memory access violations
• Repeated SMB service unavailability without legitimate cause

Detection Strategies

• Monitor SMB service availability and alert on unexpected service restarts
• Implement network intrusion detection rules for anomalous SMB setup-request packets
• Deploy packet inspection to identify malformed SMB negotiation traffic targeting MikroTik devices
• Configure logging to capture SMB service crashes with associated source IP information

Monitoring Recommendations

• Enable comprehensive logging for SMB services on RouterOS devices
• Monitor network traffic patterns for unusual SMB activity targeting router management interfaces
• Set up automated alerts for SMB service availability changes
• Implement baseline analysis for SMB traffic to detect anomalous packet patterns

How to Mitigate CVE-2020-11881

Immediate Actions Required

• Upgrade MikroTik RouterOS to a patched version beyond 6.46.5 for the 6.x branch or beyond 7.0 Beta5 for the 7.x branch
• Disable SMB services on RouterOS devices if not required for business operations
• Restrict network access to the SMB service using firewall rules to limit exposure to trusted networks only
• Monitor for exploitation attempts while planning upgrade activities

Patch Information

MikroTik has addressed this vulnerability in subsequent RouterOS releases. Administrators should update to the latest stable version of RouterOS available from the MikroTik official website. The vulnerability affects versions 6.41.3 through 6.46.5 and 7.x through 7.0 Beta5, so any version released after these should include the fix.

Workarounds

• Disable the SMB service entirely if file sharing functionality is not required using the command /ip smb set enabled=no
• Implement strict firewall rules to restrict SMB access (TCP port 445) to only trusted internal networks
• Deploy network segmentation to isolate RouterOS devices from untrusted network segments
• Use alternative file sharing mechanisms that are not affected by this vulnerability

# Disable SMB service on MikroTik RouterOS
/ip smb set enabled=no

# Restrict SMB access to trusted network only
/ip firewall filter add chain=input protocol=tcp dst-port=445 src-address=192.168.1.0/24 action=accept
/ip firewall filter add chain=input protocol=tcp dst-port=445 action=drop