Search
Find a vulnerability
Search criteria
2 vulnerabilities found for mikrotik by tomtretbar
CVE-2024-38861 (GCVE-0-2024-38861)
Vulnerability from nvd – Published: 2024-09-27 08:11 – Updated: 2024-09-27 15:21
VLAI
EPSS
VEX
Title
Lack of TLS validation in plugin MikroTik on Checkmk Exchange
Summary
Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4a_mk through 2.0a.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-27 15:21 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://exchange.checkmk.com/p/mikrotik | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-27T15:21:41.675378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-27T15:21:54.470Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://exchange.checkmk.com/packages",
"defaultStatus": "affected",
"packageName": "MikroTik",
"versions": [
{
"lessThanOrEqual": "2.5.5",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.0a",
"status": "affected",
"version": "0.4a_mk",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Hartmann of Limes Security"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Panholzer of Limes Security"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4a_mk through 2.0a."
}
],
"exploits": [
{
"lang": "en",
"value": "A PoC of an exploit was performed, where an attacker would intercept the communication, supply a self-signed certificate to the plugin and would subsequently be able to read transmitted credentials in clear-text."
}
],
"impacts": [
{
"capecId": "CAPEC-217",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-217 Exploiting Incorrectly Configured SSL/TLS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-27T10:08:54.549Z",
"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f",
"shortName": "Checkmk"
},
"references": [
{
"tags": [
"product"
],
"url": "https://exchange.checkmk.com/p/mikrotik"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of TLS validation in plugin MikroTik on Checkmk Exchange"
}
},
"cveMetadata": {
"assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f",
"assignerShortName": "Checkmk",
"cveId": "CVE-2024-38861",
"datePublished": "2024-09-27T08:11:46.790Z",
"dateReserved": "2024-06-20T10:03:09.178Z",
"dateUpdated": "2024-09-27T15:21:54.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-38861 (GCVE-0-2024-38861)
Vulnerability from cvelistv5 – Published: 2024-09-27 08:11 – Updated: 2024-09-27 15:21
VLAI
EPSS
VEX
Title
Lack of TLS validation in plugin MikroTik on Checkmk Exchange
Summary
Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4a_mk through 2.0a.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-27 15:21 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://exchange.checkmk.com/p/mikrotik | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-27T15:21:41.675378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-27T15:21:54.470Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://exchange.checkmk.com/packages",
"defaultStatus": "affected",
"packageName": "MikroTik",
"versions": [
{
"lessThanOrEqual": "2.5.5",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.0a",
"status": "affected",
"version": "0.4a_mk",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Hartmann of Limes Security"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Panholzer of Limes Security"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4a_mk through 2.0a."
}
],
"exploits": [
{
"lang": "en",
"value": "A PoC of an exploit was performed, where an attacker would intercept the communication, supply a self-signed certificate to the plugin and would subsequently be able to read transmitted credentials in clear-text."
}
],
"impacts": [
{
"capecId": "CAPEC-217",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-217 Exploiting Incorrectly Configured SSL/TLS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-27T10:08:54.549Z",
"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f",
"shortName": "Checkmk"
},
"references": [
{
"tags": [
"product"
],
"url": "https://exchange.checkmk.com/p/mikrotik"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of TLS validation in plugin MikroTik on Checkmk Exchange"
}
},
"cveMetadata": {
"assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f",
"assignerShortName": "Checkmk",
"cveId": "CVE-2024-38861",
"datePublished": "2024-09-27T08:11:46.790Z",
"dateReserved": "2024-06-20T10:03:09.178Z",
"dateUpdated": "2024-09-27T15:21:54.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}