CriticalPublic exploit

Chimay Red

IdentifiersCVE-2017-20149CWE-119

CVE-2017-20149, also known as Chimay Red, is a memory corruption vulnerability in the MikroTik RouterOS web server affecting releases before Stable 6.38.5 and Long-term 6.37.5. The flaw is reachable through the HTTP interface and can be triggered remotely by an unauthenticated attacker via a crafted HTTP request. The available context identifies the issue as memory corruption in the web server but does not provide the specific vulnerable function or code path. Successful exploitation can lead to arbitrary code execution on the affected router. The vulnerability was reportedly exploited in the wild beginning in mid-2017 and later, including by botnet operators.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote, unauthenticated arbitrary code execution on affected MikroTik RouterOS devices. Because the flaw is in the router’s web server, compromise can give an attacker control of the network appliance itself, enabling device takeover, botnet enrollment, traffic manipulation, persistence on the edge device, and use of the router as an initial access foothold. The provided context also notes in-the-wild exploitation and continued scanning activity against internet-facing targets.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict or disable exposure of the RouterOS HTTP management interface, especially from the public internet. Limit administrative access to trusted management networks, enforce network-layer access controls, and place the interface behind VPN or equivalent administrative segmentation. Monitor for exploitation attempts involving crafted HTTP requests to MikroTik web interfaces and for signs of compromise on exposed routers. Because the vulnerability has been exploited in the wild, internet-exposed unpatched systems should be treated as high risk.

Remediation

Patch, then assume compromise.

Upgrade MikroTik RouterOS to a fixed release. The vulnerable versions are releases before Stable 6.38.5 and Long-term 6.37.5, so remediation is to update to Stable 6.38.5 or later, or Long-term 6.37.5 or later, as appropriate for the deployment track. Verify that the HTTP management interface is running the patched version after upgrade.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

MikrotikRouterosoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

vulncheck blogNews

Mar 9, 2023

The VulnCheck 2022 Exploited Vulnerability Report - Missing CISA KEV Catalog Entries

A vulnerability affecting the HTTP interface of MikroTik routers (Vault 7-era leak) that has been exploited by botnets (including Hajime) and is still actively scanned.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware1

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1