Denial of Service in the SSH daemon

What is the CVE-2020-10364 vulnerability?

The vulnerability resides in the SSH daemon of the routers and allows a remote attacker to generate CPU activity, prevent the acceptance of new authorized connections, and cause the device to reboot. This occurs through “connect” and “write” system calls, due to uncontrolled resource management (CWE-770: Allocation of Resources Without Limits or Throttling).

Which RouterOS versions are vulnerable?

The affected versions and the fixed version have not yet been announced. The original description indicates that the issue is present in systems up to and including version 6.44.3.

Is my router at risk?

A router is exposed if the SSH service is active and reachable from untrusted networks, such as the Internet or uncontrolled network segments. If the SSH daemon is disabled or access is restricted exclusively to the internal administration network, the risk of remote exploitation is reduced.

Is the CVE-2020-10364 vulnerability actively exploited?

As of the date of the article, the vulnerability is not listed in the CISA KEV catalog and is not reported as exploited by ENISA. There is no evidence of known active exploitation.

How to protect the router from CVE-2020-10364?

The primary protection consists of updating the operating system to the correct version, if available. Alternatively or additionally, it is necessary to restrict access to the SSH service: disable it if not used, or configure firewall rules to allow access only from the trusted administration network, blocking connections from external networks.

Which RouterOS commands are needed to mitigate CVE-2020-10364?

Temporary mitigation: ssh service

The defect concerns the router’s SSH server. It must be made reachable only from the administration network, or turned off if you do not use it.

/ip service print
# se SSH non serve
/ip service set ssh disabled=yes
# se serve: limitalo alla rete di gestione (sostituisci con la tua)
/ip service set ssh address=192.168.88.0/24

Update RouterOS

The only definitive fix is the update. First, save the configuration; the installation reboots the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Official sources

• https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html
• https://www.exploit-db.com/exploits/48228
• https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html
• https://www.exploit-db.com/exploits/48228