CVE-2024-54772
MEDIUM 5.4EPSS 1.3%
An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.
- CVSS v3.1 CNA
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EPSS
- 1.29% chance of exploitation in the next 30 days, 70th percentile
- Nuclei
- medium · CWE-203
- Published
- 2025-02-11
- Updated
- 2025-02-24
Proof-of-concept exploits (5)
- deauther890/CVE-2024-5477234★ · 2025-02-25
- Seven11Eleven/CVE-2024-547720★ · 2025-06-12
- caster0x00/Sara348★ · 2026-10-11
- casterbyte/Sara348★ · 2026-10-11
- deauther890/RouterOS-RADIUS-InfoLeak