iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CVE-2023-32154 is a serious RouterOS flaw, but it does not affect every MikroTik router. MikroTik’s May 19, 2023 advisory says exposure requires IPv6 router-advertisement reception to be enabled with one of two specific settings. The vendor listed fixed releases and recommended disabling advertisement reception if it is not needed. The patch timing is disputed: ZDI’s account, as reported by SecurityWeek, describes a December 2022 report and a roughly five-month wait; MikroTik says it received information on May 10, 2023, and could not find a record of the earlier contact.
What CVE-2023-32154 does
MikroTik says the vulnerability can let a network-adjacent attacker execute arbitrary code on an affected RouterOS installation without authentication. SecurityWeek relays ZDI’s more specific technical account: the flaw involved RouterOS’s Router Advertisement Daemon, insufficient validation of supplied data, and a write beyond an allocated buffer, with potential code execution in the context of root. The latter details are ZDI’s description as reported by SecurityWeek.
“Network-adjacent” describes an attacker able to reach the vulnerable device over a nearby network path; it does not mean that an attacker must first authenticate to RouterOS. The risk applies only when the required configuration is present.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Am I affected by CVE-2023-32154?
MikroTik’s May 19, 2023 advisory says the issue affects RouterOS v6 and v7 devices when IPv6 advertisement receiver functionality is enabled using either of these settings:
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
ipv6/settings/ set accept-router-advertisements=yesipv6/settings/set forward=no accept-router-advertisements=yes-if-forwarding-disabled
The vendor says devices without those settings are not affected. It described the vulnerable setting combination as not normally found in routers and rarely used. That is a qualitative statement: the advisory gives no affected-device count or prevalence percentage.
To assess a device, check its installed RouterOS version and determine whether either setting is active. In a fleet, assess each device’s configuration rather than assuming that all routers on the same RouterOS branch have the same exposure. If you cannot verify the setting, consult your RouterOS configuration records or administrator before treating the device as unaffected.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
Which RouterOS versions fix the flaw?
MikroTik’s May 19, 2023 advisory lists these fixed releases and says to use a later version:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| RouterOS branch or release channel | Fixed release listed in the advisory |
|---|---|
| 7.x | 7.9.1 |
| 6.49.x | 6.49.8 |
| 6.48.x | 6.48.7 |
| 7.10 beta channel | 7.10beta8 |
These are the historical fixed versions named in that 2023 advisory, not a claim about the latest available RouterOS releases today. Check MikroTik’s current release information and your device’s version before planning an update.
Rank #3
How to reduce exposure
1. Check the device and its settings
Record the installed RouterOS version and inspect whether either affected IPv6 advertisement-receiver setting is enabled. Verify the actual configuration on the device; a model name or RouterOS major version alone does not establish exposure.
2. Choose mitigation based on how the network uses IPv6 advertisements
MikroTik’s advisory recommends disabling IPv6 advertisements or upgrading. If the device must receive router advertisements for its network role, do not disable that function without assessing the impact; upgrading is the vendor-listed remediation path. If it is unnecessary, disabling reception may be a suitable mitigation.
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
3. Update through the appropriate current channel
Use MikroTik’s current update channel and your normal change-control process. The advisory’s fixed-version list provides historical minimums for CVE-2023-32154; select a currently supported release appropriate to the device rather than treating those old version numbers as the present-day target.
4. Limit network exposure
MikroTik also recommends keeping RouterOS current and using a strong firewall to limit exposure to untrusted networks. Firewall controls are an additional safeguard, not a substitute for confirming the setting and installing an appropriate fix.
Best Value
- W128339515
Why the patch timing is disputed
SecurityWeek reported on May 23, 2023, that ZDI said it reported the flaw at Pwn2Own Toronto in December 2022, sought an update in May, and on May 10 re-disclosed the report at MikroTik’s request while allowing another week for fixes. SecurityWeek characterized the interval before a patch as roughly five months.
MikroTik’s May 19 advisory gives a different account. The company said it received information on May 10, 2023, could not find a record of the alleged December communication, and disputed the claim that it had been informed in person at Toronto, saying it was not present at the event. The available accounts do not independently resolve what communication occurred in December. The “belatedly” description reflects the timeline reported by SecurityWeek from ZDI, not an undisputed chronology.
Quick Recap
Sources
- MikroTik: CVE-2023-32154 security advisory, May 19, 2023. Primary source for affected settings, impact, remediation, and MikroTik’s account of disclosure.
- SecurityWeek: “Mikrotik Belatedly Patches RouterOS Flaw Exploited at Pwn2Own”, May 23, 2023. Reports ZDI’s timeline and technical description and MikroTik’s response.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
