MikroTik WinBox <= 6.49.17 - Username Enumeration
CVE-2024-54772
Early Release
Description
MikroTik RouterOS v6.43.13 through v6.49.13 and v6.43 through v7.17.2 contain an account enumeration issue caused by response size discrepancy in Winbox service, letting attackers identify valid usernames, exploit requires network access to Winbox service.
Severity
Medium
CVSS Score
5.3
Exploit Probability
1%
Published Date
October 11, 2026
Template Author
abdo342003
CVE-2024-54772.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2024-54772
CWE ID:
cwe-203
Remediation Steps
Update to stable release v6.49.18 or later.