CVE-2020-5720 Path traversal in MikroTik WinBox
A path traversal flaw in MikroTik WinBox allows attackers to create arbitrary files via malicious endpoints or MITM attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5720?
CVE-2020-5720 is a medium-severity path traversal vulnerability in MikroTik WinBox, published on 6 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. WinBox is vulnerable to this attack if it connects to a malicious endpoint or if an attacker mounts a man in the middle attack.
Weakness: CWE-22
Which versions are affected by CVE-2020-5720?
It affects 1 product.
Products include Mikrotik Winbox.
How do I fix CVE-2020-5720?
No fix has been published for CVE-2020-5720 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-5720 being exploited?
There is no known exploitation of CVE-2020-5720 in the wild and no public exploit code.
Other vulnerabilities in MikroTik WinBox
Sources
Also known as GHSA-v9mj-82v8-f72w.