Sign-up

ID

VAR-202208-2032


CVE

CVE-2022-34960


TITLE

MikroTik  of  routeros  Link interpretation vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-015775

DESCRIPTION

The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location on the host. MikroTik of routeros Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2022-34960 // JVNDB: JVNDB-2022-015775 // VULHUB: VHN-427953 // VULMON: CVE-2022-34960

AFFECTED PRODUCTS

vendor:mikrotikmodel:routerosscope:eqversion:7.4

Trust: 1.8

vendor:mikrotikmodel:routerosscope: - version: -

Trust: 0.8

vendor:mikrotikmodel:routerosscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-015775 // NVD: CVE-2022-34960

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-34960
value: CRITICAL

Trust: 1.0

NVD: CVE-2022-34960
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202208-3839
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2022-34960
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-34960
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-015775 // CNNVD: CNNVD-202208-3839 // NVD: CVE-2022-34960

PROBLEMTYPE DATA

problemtype:CWE-59

Trust: 1.1

problemtype:Link interpretation problem (CWE-59) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-427953 // JVNDB: JVNDB-2022-015775 // NVD: CVE-2022-34960

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202208-3839

TYPE

post link

Trust: 0.6

sources: CNNVD: CNNVD-202208-3839

PATCH

title:MikroTik RouterOS Post-link vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=206248

Trust: 0.6

sources: CNNVD: CNNVD-202208-3839

EXTERNAL IDS

db:NVDid:CVE-2022-34960

Trust: 3.4

db:JVNDBid:JVNDB-2022-015775

Trust: 0.8

db:CNNVDid:CNNVD-202208-3839

Trust: 0.6

db:VULHUBid:VHN-427953

Trust: 0.1

db:VULMONid:CVE-2022-34960

Trust: 0.1

sources: VULHUB: VHN-427953 // VULMON: CVE-2022-34960 // JVNDB: JVNDB-2022-015775 // CNNVD: CNNVD-202208-3839 // NVD: CVE-2022-34960

REFERENCES

url:https://nns.ee/blog/2022/08/05/routeros-container-rce.html

Trust: 2.6

url:https://nns.ee/blog/2022/06/21/routeros-container-rce.html

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-34960

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-34960/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-427953 // VULMON: CVE-2022-34960 // JVNDB: JVNDB-2022-015775 // CNNVD: CNNVD-202208-3839 // NVD: CVE-2022-34960

SOURCES

db:VULHUBid:VHN-427953
db:VULMONid:CVE-2022-34960
db:JVNDBid:JVNDB-2022-015775
db:CNNVDid:CNNVD-202208-3839
db:NVDid:CVE-2022-34960

LAST UPDATE DATE

2024-08-14T15:16:31.336000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-427953date:2022-08-31T00:00:00
db:VULMONid:CVE-2022-34960date:2022-08-25T00:00:00
db:JVNDBid:JVNDB-2022-015775date:2023-09-28T08:09:00
db:CNNVDid:CNNVD-202208-3839date:2022-09-01T00:00:00
db:NVDid:CVE-2022-34960date:2022-08-31T16:35:53.877

SOURCES RELEASE DATE

db:VULHUBid:VHN-427953date:2022-08-25T00:00:00
db:VULMONid:CVE-2022-34960date:2022-08-25T00:00:00
db:JVNDBid:JVNDB-2022-015775date:2023-09-28T00:00:00
db:CNNVDid:CNNVD-202208-3839date:2022-08-25T00:00:00
db:NVDid:CVE-2022-34960date:2022-08-25T02:15:19.733