35 DoS vulnerabilities in RouterOS 6.44–6.48: who is at risk and which version to install

Why one article for 35 CVEs?

Because they tell the same story 35 times. They are the result of a fuzzing campaign on the internal processes of RouterOS 6: for each one, a way to crash it was found (invalid memory access, null pointer, division by zero, failed assertion, CPU consumption) and each was assigned a CVE code. Writing 35 separate articles would not help anyone: here you find the complete table and what to do, all in one place.

Who is at risk?

The key point is in the official description of almost all of them: “an authenticated remote attacker”. To exploit them, you must already be logged in to the router. In practice, they are only dangerous if:

• someone who should not have access has a user account on the router (a former collaborator, a client with read-only access, a shared password);
• the credentials are weak or default, or exposed on the internet via WinBox, SSH, API, or WebFig;
• the router acts as a shared platform (for example, providing read-only data access to third parties for monitoring).

An external attacker without credentials cannot use them. And the damage is a service disruption, not data theft or router control: the process hangs, RouterOS restarts it, or, in the worst cases, the router reboots.

Which processes and which versions?

The version indicated is the one reported in the CVE: for some it is “6.44.6 is vulnerable”, for others “prior to 6.47”.

What should I do?

Three things, in order of importance.

Step 1: update

The CVEs indicate that versions up to 6.48.3 are vulnerable. If the router is still on RouterOS 6, upgrade the device to the latest 6.49 long-term; if the hardware allows it, consider migrating to RouterOS 7. Check the version with:

/system resource print
/system package update print

If the router is on the network:

/system package update set channel=long-term
/system package update check-for-updates
/system package update install

If you cannot reach the internet, or if you need a specific version, you can find all packages in the RouterOS Archive: select the architecture and version, and you will get direct links to download.mikrotik.com, with the manual update procedure explained in RouterOS channels.

Step 2: control who can get in

Since a login is required, the most effective defense is to reduce the number of users and access points:

/user print
/user active print
/ip service print

Remove users that are no longer needed, change shared passwords, and limit management services using Available From to administration networks only. The full procedure is in Basic hardening of a MikroTik router.

Step 3: turn off what you do not use

Many of the processes in the table run only if the feature is active or the package is installed (sniffer, btest, IGMP proxy, TR-069, PTP, lcdstat on devices with a display). Fewer active services mean a smaller attack surface, for these CVEs and for future ones. For example, the Bandwidth Test server:

/tool bandwidth-server set enabled=no