Cleartext Password Exposure in MikroTik WinBox Configuration
CVE-2020-5721

5.5MEDIUM

Key Information:

Vendor

Mikrotik

Status
Mikrotik Winbox
Vendor
CVE Published:
15 April 2020

What is CVE-2020-5721?

MikroTik WinBox version 3.22 and earlier versions have a vulnerability where user passwords are stored in cleartext within the settings.cfg.viw configuration file. This occurs when the 'Keep Password' option is enabled, which is set by default, and no Master Password is established. An attacker with access to this configuration file can easily extract both the username and password, potentially allowing unauthorized access to the router.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MikroTik WinBox 3.22 and below

References

https://www.tenable.com/security/research/tra-2020-23
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.