CVE-2020-10364

Exploit

EPSS 2.66%
Veröffentlicht 23.03.2020 16:15:13
Zuletzt bearbeitet 21.11.2024 04:55:09
Erkennungen
Login

The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mikrotik ≫ Routeros Version <= 6.44.3

   Mikrotik ≫ Ccr1009-7g-1c-1s+ Version -
   Mikrotik ≫ Ccr1009-7g-1c-1s+pc Version -
   Mikrotik ≫ Ccr1009-7g-1c-pc Version -
   Mikrotik ≫ Ccr1016-12g Version -
   Mikrotik ≫ Ccr1016-12s-1s+ Version -
   Mikrotik ≫ Ccr1036-12g-4s Version -
   Mikrotik ≫ Ccr1036-12g-4s-em Version -
   Mikrotik ≫ Ccr1036-8g-2s+ Version -
   Mikrotik ≫ Ccr1036-8g-2s+em Version -
   Mikrotik ≫ Ccr1072-1g-8s+ Version -
   Mikrotik ≫ Hex Version -
   Mikrotik ≫ Hex Lite Version -
   Mikrotik ≫ Hex Poe Version -
   Mikrotik ≫ Hex Poe Lite Version -
   Mikrotik ≫ Hex S Version -
   Mikrotik ≫ Powerbox Version -
   Mikrotik ≫ Powerbox Pro Version -
   Mikrotik ≫ Rb1100ahx4 Version -
   Mikrotik ≫ Rb1100ahx4 Version - Edition dude
   Mikrotik ≫ Rb2011il-in Version -
   Mikrotik ≫ Rb2011il-rm Version -
   Mikrotik ≫ Rb2011ils-in Version -
   Mikrotik ≫ Rb2011uias-in Version -
   Mikrotik ≫ Rb2011uias-rm Version -
   Mikrotik ≫ Rb3011uias-rm Version -
   Mikrotik ≫ Rb4011igs+rm Version -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.66%	0.843

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	7.8	10	6.9	AV:N/AC:L/Au:N/C:N/I:N/A:C

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html

Third Party Advisory

Exploit

VDB Entry

Mitigation

https://www.exploit-db.com/exploits/48228

Third Party Advisory

Exploit

VDB Entry

Mitigation

https://nvd.nist.gov/vuln/detail/CVE-2020-10364

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-10364

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-10364

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2020-10364