Access Control Flaw in MikroTik RouterOS by MikroTik
CVE-2023-41570

5.3MEDIUM

Key Information:

Vendor

Mikrotik

Status
Routeros
Vendor
CVE Published:
14 November 2023

What is CVE-2023-41570?

MikroTik RouterOS versions 7.1 to 7.11 are affected by an access control vulnerability in the Rest API. This flaw allows unauthorized access to sensitive functionality, potentially enabling attackers to perform actions without proper authentication. The issue stems from inadequate enforcement of access controls, which can lead to exploitation of the API by malicious entities. Users are encouraged to review their configurations and implement necessary security measures to mitigate potential risks.

References

https://www.enricobassetti.it/2023/11/cve-2023-41570-acce...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.