Cleartext Password Exposure in MikroTik WinBox Configuration
CVE-2020-5721

5.5MEDIUM

Key Information:

Vendor

Mikrotik

Status
Mikrotik Winbox
Vendor
CVE Published:
15 April 2020

What is CVE-2020-5721?

MikroTik WinBox version 3.22 and earlier versions have a vulnerability where user passwords are stored in cleartext within the settings.cfg.viw configuration file. This occurs when the 'Keep Password' option is enabled, which is set by default, and no Master Password is established. An attacker with access to this configuration file can easily extract both the username and password, potentially allowing unauthorized access to the router.

Affected Version(s)

MikroTik WinBox 3.22 and below

References

https://www.tenable.com/security/research/tra-2020-23
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.