Vulnerabilityhigh
Experts warn of 7,500+ MikroTik Routers that are hijacking owners’ traffic
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-14847 | Directory Traversal in MikroTik RouterOS Winbox Interface (Unauthenticated File Read) | 9.1 | 96% | KEVPoC ×7 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 37.1.207.114 | gnificant number of devices have their traffic going to the 37.1.207.114 IP. Don’t waste time, update the MikroTik devices and also |
| ipv4 | 95.154.216.128 | 4 proxy config only allows access from one single net-block 95.154.216.128/25.” states the report “In order for the attacker to gain c |
| ipv4 | 95.154.216.167 | low access from 95.154.216.128/25, actually mainly from the 95.154.216.167 address. Eavesdropping The MikroTik RouterOS devices to cap |
From the original article
3 min read at securityaffairs.com
The security firm Qihoo 360 Netlab discovered more than 7,500 MikroTik routers that have been compromised to enable Socks4 proxy maliciously Earlier August, experts uncovered a massive crypto jacking campaign that was targeting MikroTik routers to inject a Coinhive cryptocurrency mining script in the web traffic.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.