CVE-2024-54772

An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.78% chance of exploitation in the next 30 days, 53th percentile

Published

2025-02-11

Updated

2025-02-24

Proof-of-concept exploits (4)

• deauther890/CVE-2024-5477233★ · 2025-02-25
• Seven11Eleven/CVE-2024-547720★ · 2025-06-12
• caster0x00/Sara334★ · 2026-05-12
• casterbyte/Sara334★ · 2026-05-12

References

• CVE Record
• NVD entry

Related

• CVE-2024-54767
• CVE-2024-54774
• CVE-2024-54764
• CVE-2024-54792
• CVE-2024-54763
• CVE-2024-54794