CVE-2020-5721

MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Password is not set. An attacker with access to the configuration file can extract a username and password to gain access to the router.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.tenable.com/security/research/tra-2020-23	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:mikrotik:winbox:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-04-15 21:15

Updated : 2020-04-28 15:44

NVD link : CVE-2020-5721

Mitre link : CVE-2020-5721

CVE.ORG link : CVE-2020-5721

JSON object : View

Products Affected

mikrotik

winbox

CWE

CWE-522

Insufficiently Protected Credentials

CWE-260

Password in Configuration File

{"id": "CVE-2020-5721", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2020-04-15T21:15:36.607", "references": [{"url": "https://www.tenable.com/security/research/tra-2020-23", "tags": ["Exploit", "Third Party Advisory"], "source": "vulnreport@tenable.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Secondary", "source": "vulnreport@tenable.com", "description": [{"lang": "en", "value": "CWE-260"}]}], "descriptions": [{"lang": "en", "value": "MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Password is not set. An attacker with access to the configuration file can extract a username and password to gain access to the router."}, {"lang": "es", "value": "MikroTik WinBox versiones 3.22 y por debajo, almacenan la contrase\u00f1a de texto sin cifrar del usuario en el archivo de configuraci\u00f3n settings.cfg.viw cuando se establece el campo Keep Password y Master Password no se establece. Keep Password se establece por defecto y, Master Password por defecto no se establece. Un atacante con acceso al archivo de configuraci\u00f3n puede extraer un nombre de usuario y contrase\u00f1a para conseguir acceso al router."}], "lastModified": "2020-04-28T15:44:00.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mikrotik:winbox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91019170-B8B8-4975-AAB4-AB69278BC874", "versionEndIncluding": "3.22"}], "operator": "OR"}]}], "sourceIdentifier": "vulnreport@tenable.com"}