However, using a customized malicious DNS server, an attacker can inject a range of malicious IP addresses into the router’s cache, including the download address. The relevant changelog states, “downgrading to any version prior to v6.43 (v6.42.12 and older) will clear all user passwords and allow password-less authentication.” From version 6.43, MikroTik password handling changed.

The next step in the chain is to downgrade the software to version 6.42.12 or earlier.

“Since we can specify the DNS server the request should go through, it’s trivial to inject bad addresses,” writes a Tenable researcher in a blog post describing the vulnerabilities.

Three available commands can allow an unauthenticated remote user to make DNS requests through the router to a DNS server of their own choice. Messages sent to the Winbox port can be sent to different binaries, including resolver. DNS lookups are handled by a ‘resolver’ binary, which is hooked into the RouterOS’s Winbox protocol. The default setting for the DNS server is disabled, but the router still maintains its own DNS cache. It said, “By chaining these vulnerabilities, an unauthenticated remote attacker with access to port 8291 on the router, can perform a RouterOS downgrade, reset the system passwords, and potentially gain a root shell.” MikroTik released patches on October 28, 2019. Tenable found the vulnerabilities and disclosed two to MikroTik on Septem( CVE-2019-3976 and CVE-2019-3977) and two more on Septem( CVE-2019-3978 and CVE-2019-3979). The chain starts with DNS poisoning, goes on to downgrading the installed version of MikroTik’s RouterOS software, and ends with enabling a backdoor.

A chain of vulnerabilities in MikroTik routers could allow an attacker to gain a backdoor.

Routeros winbox