CVE-2024-27686

Executive Summary

CVE-2024-27686 is a denial-of-service (DoS) vulnerability affecting MikroTik RouterOS (x86) versions 6.40.5 through 6.49.10. A remote, unauthenticated attacker can trigger a device crash by sending crafted packet data to the SMB service on TCP port 445. The vulnerability is fixed in RouterOS version 7.x. No public proof-of-concept (PoC) or exploit code has been released at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the impact is high for affected systems as it can cause complete service disruption.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which likely indicates a placeholder or incomplete scoring. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High. The vulnerability allows a remote attacker to crash the device without authentication, leading to complete loss of availability for the router and all connected networks.

Deep Dive & Mechanics

The vulnerability resides in the SMB (Server Message Block) service implementation within MikroTik RouterOS. SMB is a network file sharing protocol typically used on Windows systems. MikroTik includes a lightweight SMB server for file sharing on the router.

The issue is a classic input validation failure (CWE-20). The SMB service does not properly validate or sanitize incoming packet data. By sending a specially crafted SMB packet, an attacker can trigger a memory corruption or an unhandled exception within the service, causing the entire RouterOS kernel to crash and reboot.

The crash is likely due to a buffer overflow, null pointer dereference, or an infinite loop triggered by malformed SMB negotiation or session setup requests. Since the SMB service runs with high privileges (often as part of the kernel or a critical system process), a crash in this service results in a full system panic and reboot.

Vulnerable vs. Patched Code

No specific code diff is publicly available. However, the fix involves upgrading to RouterOS version 7.x, which includes a rewritten or significantly hardened SMB stack. The patched code likely includes:

• Proper bounds checking on SMB packet fields (e.g., buffer sizes, offsets).
• Input validation for SMB command codes and parameters.
• Safe handling of malformed or unexpected packet structures.
• Removal of deprecated or unsafe SMB dialect support.

Vulnerable: RouterOS 6.40.5 - 6.49.10 (SMB service enabled) Patched: RouterOS 7.x (any version)

Exploitation & Lab Setup

Red Team

Objective: Crash a MikroTik RouterOS device running a vulnerable version.

Prerequisites:

• Target IP with port 445 open (SMB service).
• Ability to send raw TCP packets.

Exploitation Steps:

1. Identify Target: Use Shodan or Nmap to find MikroTik devices with SMB exposed.

   nmap -p 445 --script smb-os-discovery <target_ip>
   

2. Craft Malformed SMB Packet: Since no public exploit exists, you would need to reverse-engineer the SMB implementation. A likely approach is to send an SMB Negotiate Protocol Request with an invalid or oversized field.

   Example Python script (conceptual):

   import socket
   
   def crash_mikrotik(target_ip):
       # SMB Negotiate Protocol Request with malformed data
       smb_packet = bytes([
           0x00, 0x00, 0x00, 0x90,  # NetBIOS session header
           0xFF, 0x53, 0x4D, 0x42,  # SMB magic
           0x72, 0x00, 0x00, 0x00,  # SMB command: Negotiate
           # ... malformed payload ...
       ])
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       sock.connect((target_ip, 445))
       sock.send(smb_packet)
       sock.close()
   
   crash_mikrotik("192.168.1.1")
   

3. Verify Crash: The device will become unresponsive. Ping or SSH will fail. The router will reboot automatically.

Blue Team

Detection & Prevention:

1. Disable SMB Service: If not required, disable the SMB service on RouterOS.

   /ip smb set enabled=no
   

2. Network Segmentation: Restrict access to port 445 from untrusted networks using firewall rules.

   /ip firewall filter add chain=input protocol=tcp dst-port=445 src-address-list=trusted action=accept
   /ip firewall filter add chain=input protocol=tcp dst-port=445 action=drop
   

3. Monitor for Anomalous SMB Traffic: Use network monitoring tools to detect malformed SMB packets.

4. Upgrade Firmware: Apply the patch by upgrading to RouterOS 7.x.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual SMB packets with invalid fields or oversized payloads.
  • Repeated connection attempts to port 445 from a single source.
  • Device logs showing unexpected reboots or kernel panics.

• System IOCs:

  • RouterOS crash logs (if accessible) showing SMB-related errors.
  • Uptime reset indicating a reboot.

• Log Examples:

  /log print where message~"SMB"
  

Detection Engineering

YARA Rule

rule CVE_2024_27686_MikroTik_SMB_DoS {
    meta:
        description = "Detects malformed SMB packets targeting MikroTik RouterOS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-27686"
    strings:
        $smb_magic = { FF 53 4D 42 }
        $neg_proto = { 72 00 00 00 }  // SMB_COM_NEGOTIATE
        $malformed_len = { 00 00 00 [4-8] }  // Suspicious length fields
    condition:
        $smb_magic at 4 and $neg_proto and #malformed_len > 2
}

Sigma Rule

title: CVE-2024-27686 MikroTik SMB DoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic attempting to exploit CVE-2024-27686
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 445
        app_protocol: smb
        smb.command: "SMB_COM_NEGOTIATE"
        smb.status: "STATUS_INVALID_PARAMETER"
    condition: selection
falsepositives:
    - Legitimate SMB clients with misconfigured settings
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"CVE-2024-27686 MikroTik SMB DoS Attempt"; flow:to_server,established; content:"|FF 53 4D 42|"; offset:4; depth:4; content:"|72 00 00 00|"; within:5; byte_test:4,>,100,0,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade RouterOS: Update to version 7.x or later.

   /system routerboard print
   /system package update install
   

2. Disable SMB: If SMB is not required, disable it.

   /ip smb set enabled=no
   

3. Firewall Rules: Restrict access to port 445.

   /ip firewall filter add chain=input protocol=tcp dst-port=445 action=drop
   

Long-Term Measures:

• Implement network segmentation to limit exposure of management interfaces.
• Regularly audit and update firmware.
• Monitor for unusual SMB traffic patterns.

Valters IT