What’s Vulnerable › Vulnerabilities
CVE-2024-54772
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-02-11 · updated 2026-06-17
- Weakness: CWE-208
Description
An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.
Affected products
- MikroTik RouterOS: from 6.43 before 6.49.18; from 6.43.13 through 6.49.13; from 7.1 before 7.18 — fixed in 6.49.18, 7.18
How to fix
Upgrade to a fixed version: MikroTik RouterOS 6.49.18, 7.18. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-54772 or the next vulnerability affects your stack