CVE-2024-54772

An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.

• CWE-208

• https://github.com/deauther890/CVE-2024-54772Exploit, Third Party Advisory

Published

Feb 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-54761BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injectio…6.3
• CVE-2024-54762Ruoyi v.4.7.9 and before contains an authenticated SQL injec…6.3
• CVE-2024-54763An access control issue in the component /login/hostinfo.cgi…6.5
• CVE-2024-54764An access control issue in the component /login/hostinfo2.cg…6.5
• CVE-2024-54767An access control issue in the component /juis_boxinfo.xml o…7.5
• CVE-2024-5477A potential security vulnerability has been identified in th…7.3
• CVE-2024-54774Dcat Admin v2.2.0-beta contains a cross-site scripting (XSS)…4.8
• CVE-2024-54775Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site…4.8
• CVE-2024-54779Netgate pfSense CE (prior to 2.8.0 beta release) and corresp…5.4
• CVE-2024-5478A Cross-site Scripting (XSS) vulnerability exists in the SAM…6.1
• CVE-2024-54780Netgate pfSense CE (prior to 2.8.0 beta release) and corresp…8.8
• CVE-2024-5479The Easy Pixels plugin for WordPress is vulnerable to Stored…7.2