CVE-2024-54772

Executive Summary

CVE-2024-54772 is an information disclosure vulnerability in MikroTik RouterOS affecting the Winbox service (TCP port 8291). The flaw allows remote, unauthenticated attackers to enumerate valid usernames by observing a discrepancy in response size between connection attempts made with a valid username and those with an invalid username. This username enumeration can serve as a precursor to brute-force or credential-stuffing attacks. The vulnerability affects both long-term and stable release branches, with a patch available in stable release v6.49.18. No public exploit code or Nuclei template has been released at this time.

Supply Chain & Package Security

This vulnerability is not related to any software supply chain or package manager (NPM, PyPI, Go, Ruby). It is a network service vulnerability in MikroTik RouterOS firmware.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD assigned, likely due to incomplete data)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – only username enumeration
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: Medium (due to potential for chaining with brute-force attacks)

Deep Dive & Mechanics

The Winbox service on MikroTik RouterOS is used for remote management via the Winbox GUI application. The vulnerability stems from an observable difference in the size of the server's response when a connection attempt is made with a valid username versus an invalid username. This is a classic example of an information exposure through discrepancy (CWE-203).

When an attacker sends a crafted Winbox connection request containing a username, the server processes the request and returns a response. If the username exists in the system, the server returns a response of a certain size (e.g., including a challenge or error message specific to that user). If the username does not exist, the server returns a different response size (e.g., a generic "invalid username" message). By measuring the response size, an attacker can determine whether a given username is valid.

This enumeration can be performed without authentication, making it a low-barrier attack. The attacker can use a wordlist of common usernames (e.g., admin, user, guest) to quickly identify valid accounts. Once valid usernames are identified, the attacker can proceed with password brute-forcing or credential-stuffing attacks.

Vulnerable vs. Patched Code

The vulnerability is not in a specific code snippet but in the behavior of the Winbox service. The patch in v6.49.18 likely normalizes the response size for both valid and invalid usernames, making them indistinguishable.

Vulnerable Behavior (pre-patch):

• Valid username: Response size = X bytes (e.g., 128 bytes)
• Invalid username: Response size = Y bytes (e.g., 64 bytes)

Patched Behavior (post-patch):

• Valid username: Response size = Z bytes (e.g., 128 bytes)
• Invalid username: Response size = Z bytes (same as valid)

The exact implementation details are not publicly available, but the fix likely involves padding the response for invalid usernames to match the size of a valid username response.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable MikroTik RouterOS device (e.g., v6.43.13 or v7.17.2) with Winbox service exposed on TCP port 8291.
• A network connection to the target device.
• A wordlist of potential usernames (e.g., admin, user, guest, root).

Exploitation Steps:

1. Identify the target: Use Shodan or Nmap to find devices with port 8291 open.

   nmap -p 8291 --open <target_ip>
   

2. Craft a Winbox connection request: Use a tool like netcat or a custom Python script to send a Winbox connection request with a specific username.

3. Measure response size: Capture the response and measure its size.

4. Enumerate usernames: Repeat steps 2-3 for each username in the wordlist. Compare response sizes to identify valid usernames.

Example Python Script (Conceptual):

import socket

def check_username(target_ip, username):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(5)
    try:
        sock.connect((target_ip, 8291))
        # Craft Winbox connection request (simplified)
        request = b"\x00" * 4 + username.encode() + b"\x00"
        sock.send(request)
        response = sock.recv(4096)
        return len(response)
    except:
        return None
    finally:
        sock.close()

target = "192.168.1.1"
usernames = ["admin", "user", "guest", "root"]
for user in usernames:
    size = check_username(target, user)
    if size:
        print(f"Username: {user}, Response size: {size}")

Blue Team

Detection:

• Monitor for multiple connection attempts to port 8291 from the same source IP within a short time frame.
• Look for anomalous patterns in Winbox connection logs (if available).
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Apply the patch by upgrading to RouterOS stable release v6.49.18 or later.
• Restrict access to the Winbox service using firewall rules (e.g., allow only trusted IPs).
• Enable logging and alerting for Winbox connection attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Multiple connection attempts to TCP port 8291 from the same source IP.
  • Unusual response sizes from the Winbox service (e.g., varying sizes for different usernames).
• Host IOCs:
  • Unauthorized user accounts created or modified.
  • Failed login attempts followed by successful logins from the same source IP.
• Log IOCs:
  • Winbox service logs showing repeated connection attempts with different usernames.

Detection Engineering

YARA Rule

rule CVE_2024_54772_Winbox_Enumeration {
    meta:
        description = "Detects Winbox username enumeration attempts based on response size discrepancy"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-54772"
    strings:
        $winbox_magic = { 00 00 00 00 }  // Winbox protocol magic bytes
        $valid_response = { 48 65 6C 6C 6F }  // Example valid response pattern (adjust as needed)
    condition:
        $winbox_magic at 0 and #valid_response > 0
}

Sigma Rule

title: Winbox Username Enumeration Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple Winbox connection attempts with different usernames from the same source IP
author: Valters IT
date: 2025-04-17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54772
logsource:
    category: network
    product: mikrotik
    service: winbox
detection:
    selection:
        src_ip: "*"
        dst_port: 8291
    condition: selection | count(src_ip) by src_ip > 10 within 60 seconds
falsepositives:
    - Legitimate Winbox management from multiple users
level: medium

Suricata Rule

alert tcp any any -> any 8291 (msg:"CVE-2024-54772 Winbox Username Enumeration Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; byte_test:1,!=,0,4; threshold:type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Upgrade all MikroTik RouterOS devices to stable release v6.49.18 or later.
   • If immediate upgrade is not possible, restrict access to the Winbox service using firewall rules to allow only trusted IP addresses.

2. Long-term Measures:

   • Implement network segmentation to limit exposure of management interfaces.
   • Use strong, unique passwords for all user accounts.
   • Enable multi-factor authentication (MFA) for Winbox access if supported.
   • Regularly audit user accounts and remove unused or unnecessary accounts.
   • Monitor logs for suspicious activity and implement automated alerting.

3. Workarounds:

   • Disable the Winbox service if not required, and use SSH or API for management instead.
   • Use a VPN to access the management network, reducing exposure to the internet.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert