CVE-2024-54772: MikroTik RouterOS Information Disclosure

CVE-2024-54772 Overview

An information disclosure vulnerability has been discovered in the Winbox service of MikroTik RouterOS. The vulnerability exists due to a timing-based discrepancy in response sizes between connection attempts made with valid usernames versus invalid usernames. This side-channel attack allows remote attackers to enumerate valid user accounts on affected MikroTik devices, potentially facilitating further attacks such as password brute-forcing or targeted credential stuffing.

Critical Impact

Attackers can remotely enumerate valid usernames on MikroTik routers via the Winbox service, enabling reconnaissance for subsequent authentication attacks against network infrastructure.

Affected Products

• MikroTik RouterOS Long-Term Release v6.43.13 through v6.49.13
• MikroTik RouterOS Stable Release v6.43 through v7.17.2
• MikroTik RouterOS Stable Release versions prior to v6.49.18

Discovery Timeline

• 2025-02-11 - CVE-2024-54772 published to NVD
• 2025-06-30 - Last updated in NVD database

Technical Details for CVE-2024-54772

Vulnerability Analysis

This vulnerability is classified under CWE-208 (Observable Timing Discrepancy), a side-channel weakness that occurs when an application's behavior reveals sensitive information through measurable timing or response size differences. In the case of CVE-2024-54772, the Winbox service—MikroTik's proprietary Windows-based configuration utility that communicates over TCP port 8291—exhibits different response characteristics depending on whether a submitted username exists in the system.

When an attacker sends authentication requests to the Winbox service, the response payload size differs between attempts using valid usernames and those using non-existent usernames. By analyzing these response size discrepancies, an attacker can systematically determine which usernames are valid on the target device without requiring any authentication credentials.

Root Cause

The root cause of this vulnerability lies in the inconsistent handling of authentication requests within the Winbox service. The application fails to provide uniform responses for both valid and invalid username attempts, violating the security principle of indistinguishable error handling. This allows attackers to infer the validity of usernames based on observable differences in the network responses, creating an oracle that can be queried to enumerate accounts.

Attack Vector

The attack vector is network-based and requires low privileges to execute. An attacker with network access to the Winbox service (TCP port 8291) can send multiple authentication requests with different usernames and measure the response sizes. The exploitation process involves:

1. Establishing a connection to the target's Winbox service on TCP port 8291
2. Sending authentication requests with various candidate usernames
3. Recording and comparing response sizes for each attempt
4. Identifying valid usernames where response sizes differ from the baseline invalid username response
5. Compiling a list of valid accounts for subsequent password attacks

The vulnerability is accessible from the network without user interaction, making it suitable for automated enumeration attacks. Technical details and proof-of-concept materials are available in the GitHub PoC Repository.

Detection Methods for CVE-2024-54772

Indicators of Compromise

• High volume of failed authentication attempts against the Winbox service (TCP port 8291) from a single source IP
• Sequential or systematic username patterns in Winbox authentication logs indicating enumeration activity
• Unusual connection patterns to port 8291 with rapid connection/disconnection cycles
• Authentication logs showing attempts with common or dictionary-based usernames

Detection Strategies

• Implement network monitoring to detect anomalous connection rates to TCP port 8291
• Configure SIEM rules to alert on excessive failed Winbox authentication attempts within a short time window
• Deploy IDS/IPS signatures to identify username enumeration patterns against MikroTik devices
• Enable and monitor RouterOS logging for the Winbox service to capture authentication events

Monitoring Recommendations

• Enable verbose logging for the Winbox service on all MikroTik devices
• Establish baseline metrics for normal Winbox authentication traffic patterns
• Configure alerts for deviation from normal authentication attempt frequencies
• Implement network flow analysis to identify reconnaissance activity targeting management interfaces

How to Mitigate CVE-2024-54772

Immediate Actions Required

• Upgrade MikroTik RouterOS to stable release v6.49.18 or later, which contains the security patch
• Restrict access to the Winbox service (TCP port 8291) to trusted management networks only
• Implement firewall rules to limit source IPs that can connect to the Winbox service
• Consider disabling Winbox and using SSH or the web interface with proper access controls

Patch Information

MikroTik has released a patch in the stable release v6.49.18 that addresses this username enumeration vulnerability. Organizations should prioritize upgrading all affected RouterOS devices to this version or later. The patch ensures consistent response handling regardless of username validity, eliminating the observable timing discrepancy.

Workarounds

• Disable the Winbox service entirely if not required for administrative tasks (/ip service disable winbox)
• Implement IP-based access restrictions for the Winbox service to allow only trusted management hosts
• Deploy a VPN solution to require authenticated access before reaching the Winbox service
• Use alternative management interfaces such as SSH or HTTPS with appropriate access controls

# MikroTik RouterOS configuration to restrict Winbox access
/ip service
set winbox address=192.168.1.0/24,10.0.0.0/8 disabled=no

# Alternative: Disable Winbox service entirely
/ip service disable winbox

# Enable SSH as alternative management interface
/ip service enable ssh
/ip service set ssh port=22 address=192.168.1.0/24