Buffer overflow in the SMB server of RouterOS

What is the CVE-2020-22844 vulnerability?

CVE-2020-22844 is a buffer overflow present in Mikrotik RouterOS 6.47 that allows an unauthenticated attacker to cause a denial of service (DoS) by sending specially crafted SMB requests. The underlying weakness is classified as “Missing Release of Memory after Effective Lifetime” (CWE-401).

Which RouterOS versions are vulnerable?

The vulnerability description explicitly states that RouterOS version 6.47 is affected. The specific affected versions and fixed versions have not been disclosed in the available sources.

Is my router at risk?

A router is exposed to CVE-2020-22844 if it runs RouterOS 6.47, has the SMB file sharing service enabled, and is reachable from untrusted networks. Since the SMB service is rarely used in production environments, the risk is significantly reduced if this service is disabled.

Is the CVE-2020-22844 vulnerability actively exploited?

As of the date of this article, there is no evidence that CVE-2020-22844 is being actively exploited. The vulnerability is not listed in the CISA KEV catalog, and ENISA does not report it as being exploited.

How to protect the router from CVE-2020-22844?

The primary measure is to update the firmware to a version later than 6.47, if available and stable. Alternatively, you can mitigate the risk by completely disabling the SMB service on the router, as the vulnerability requires interaction with this specific component to be exploited.

Which RouterOS commands are needed to mitigate CVE-2020-22844?

Temporary mitigation: smb service

The flaw concerns the router’s SMB file sharing server, which almost no one uses in production: it should be turned off.

/ip smb print
/ip smb set enabled=no

Update RouterOS

The only definitive fix is an update. Save the configuration first; the installation will reboot the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Official sources

• https://github.com/colorlight/mikrotik_poc/blob/master/two_vulns.md
• https://mikrotik.com/support
• https://github.com/colorlight/mikrotik_poc/blob/master/two_vulns.md
• https://mikrotik.com/support