Researcher Details Nine-Year-Old MikroTik RouterOS Pre-Authentication RCE

Summary

NiNi explains how crafted IPv6 router advertisements exploited a stack buffer overflow in MikroTik RouterOS and how a race condition affected exploit reliability. The vulnerability was fixed.

Key points

• The researcher identified CVE-2023-32154 in RouterOS code that constructs IPv6 router advertisements.
• Two crafted advertisements with large recursive DNS server lists could trigger a stack buffer overflow and enable pre-authentication code execution.
• The vulnerable code had existed since at least RouterOS v6, released in 2013, and was fixed approximately a year after discovery.
• The team found that a race condition between the router advertisement service and resolver affected exploit reliability; adjusting packet timing and the payload stabilized the exploit.
• The team chained the router exploit with a Canon printer exploit in a Pwn2Own contest and reported success in the SOHO Smashup category.