by Kastro
Paper/Archive/CVE-2022-34960

CVE-2022-34960

mitre — The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve t…

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 75.1.751 × 2015.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location on the host.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refnns.ee/blog/2022/06/21/routeros-container-rce.htmlrefnns.ee/blog/2022/08/05/routeros-container-rce.html