CVE-2020-22844
📋 TL;DR
A buffer overflow vulnerability in Mikrotik RouterOS 6.47 allows unauthenticated attackers to send crafted SMB requests that cause a denial of service (DoS). This affects Mikrotik RouterOS devices running version 6.47 with SMB services enabled. Attackers can crash the router without authentication.
💻 Affected Systems
- Mikrotik RouterOS
📦 What is this software?
Routeros by Mikrotik
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, extended network downtime, and potential for remote code execution if combined with other vulnerabilities.
Likely Case
Router becomes unresponsive, causing network disruption until manually rebooted.
If Mitigated
No impact if SMB services are disabled or router is patched.
🎯 Exploit Status
Proof-of-concept code is publicly available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.48 or later
Vendor Advisory: https://mikrotik.com/support
Restart Required: Yes
Instructions:
1. Log into RouterOS web interface or CLI. 2. Check current version with '/system package update check'. 3. Update to 6.48 or later via '/system package update install'. 4. Reboot router.
🔧 Temporary Workarounds
Disable SMB Service
allDisable the vulnerable SMB service to prevent exploitation.
/ip smb set enabled=no
🧯 If You Can't Patch
- Disable SMB service immediately using '/ip smb set enabled=no'
- Restrict SMB access to trusted networks using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check RouterOS version with '/system resource print' - if version is 6.47 and SMB is enabled, system is vulnerable.Check Version:
/system resource printVerify Fix Applied:
Verify version is 6.48 or later with '/system resource print' and confirm SMB is disabled or patched.📡 Detection & Monitoring
Log Indicators:
- Router crash logs
- SMB service failure entries
- Unusual SMB traffic patterns
Network Indicators:
- Malformed SMB packets to router port 445
- Router becoming unresponsive after SMB traffic
SIEM Query:
source="router" AND (event="crash" OR port=445 AND protocol="SMB" AND size>normal)