CVE-2020-10364

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-10364
The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html Exploit Mitigation Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/48228 Exploit Mitigation Third Party Advisory VDB Entry
https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html Exploit Mitigation Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/48228 Exploit Mitigation Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*
OR cpe:2.3:h:mikrotik:ccr1009-7g-1c-1s\+:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1009-7g-1c-1s\+pc:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1009-7g-1c-pc:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1016-12g:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1016-12s-1s\+:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1036-12g-4s:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1036-12g-4s-em:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1036-8g-2s\+:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1036-8g-2s\+em:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:ccr1072-1g-8s\+:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:hex:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:hex_lite:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:hex_poe:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:hex_poe_lite:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:hex_s:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:powerbox:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:powerbox_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:rb1100ahx4:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:rb1100ahx4:-:*:dude:*:*:*:*:*
cpe:2.3:h:mikrotik:rb2011il-in:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:rb2011il-rm:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:rb2011ils-in:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:rb2011uias-in:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:rb2011uias-rm:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:rb3011uias-rm:-:*:*:*:*:*:*:*
cpe:2.3:h:mikrotik:rb4011igs\+rm:-:*:*:*:*:*:*:*
History

21 Nov 2024, 04:55

Type Values Removed Values Added
References () https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html - Exploit, Mitigation, Third Party Advisory, VDB Entry () https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html - Exploit, Mitigation, Third Party Advisory, VDB Entry
References () https://www.exploit-db.com/exploits/48228 - Exploit, Mitigation, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/48228 - Exploit, Mitigation, Third Party Advisory, VDB Entry

25 May 2021, 14:37

Type Values Removed Values Added
CVSS v2 : 5.0
v3 : 7.5 		v2 : 7.8
v3 : 7.5
CPE cpe:2.3:o:mikrotik:ccr1072-1g-8s\+_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb2011il-in_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb2011ils-in_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:powerbox_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:hex_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1009-7g-1c-1s\+_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1016-12s-1s\+_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:hex_poe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1036-8g-2s\+em_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:hex_poe_lite_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb1100ahx4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1016-12g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb2011uias-in_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:hex_s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1036-12g-4s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb2011uias-rm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb2011il-rm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb3011uias-rm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb1100ahx4_firmware:*:*:dude:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1036-8g-2s\+_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1036-12g-4s-em_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1009-7g-1c-1s\+pc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:powerbox_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:rb4011igs\+rm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:ccr1009-7g-1c-pc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mikrotik:hex_lite_firmware:*:*:*:*:*:*:*:*		 cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*
Information

Published : 2020-03-23 16:15

Updated : 2024-11-21 04:55

NVD link : CVE-2020-10364

Mitre link : CVE-2020-10364

CVE.ORG link : CVE-2020-10364

JSON object : View

Products Affected

mikrotik

  • ccr1036-12g-4s-em
  • ccr1016-12g
  • ccr1036-12g-4s
  • ccr1016-12s-1s\+
  • hex_s
  • ccr1036-8g-2s\+
  • rb3011uias-rm
  • hex_poe_lite
  • ccr1009-7g-1c-pc
  • powerbox
  • rb2011ils-in
  • ccr1009-7g-1c-1s\+pc
  • powerbox_pro
  • ccr1036-8g-2s\+em
  • hex
  • ccr1072-1g-8s\+
  • ccr1009-7g-1c-1s\+
  • routeros
  • rb1100ahx4
  • rb4011igs\+rm
  • rb2011uias-rm
  • rb2011il-in
  • rb2011il-rm
  • rb2011uias-in
  • hex_lite
  • hex_poe
CWE
CWE-770

Allocation of Resources Without Limits or Throttling