A pre-authentication rekey state bypass vulnerability has been reported in MikroTik RouterOS which could allow an unauthenticated remote attacker to bypass the expected SSH authentication workflow, open a session channel and send an execution request on affected devices.
Target Audience:
Organizations and network administrators using affected MikroTik RouterOS devices.
Risk Assessment:
Risk of unauthorized operations within the RouterOS managed file namespace, including creation, overwriting and reconstruction of files containing configuration and diagnostic information.
Impact Assessment:
Potential for unauthorized file creation, modification or reconstruction, including files containing configuration and diagnostic information, and unauthorized operations on affected RouterOS devices.
The information provided herein is on "as is" basis, without warranty of any kind.