SOC L1 Threat Investigation: MikroTik RouterOS Multiple Exposed Services

Analyst: Jonatan Alexander Guerrero Gomez | Role Target: SOC L1 / Jr. Cybersecurity Analyst Status: Investigation Closed | Severity: High

Executive Summary

Proactive threat hunting exercise indentifying a public-facing MikroTik RouterOS device with multiple exposed services. Investigation correlated the exposed Bandwidth-Test service on 2000/TCP with CVE-2018-1156, a high-severity RCE vulnerability. Additional exposure of L2TP VPN on 1701/UDP increases the attack surface. This case demonstrates L1 competencies: asset discovery, service enumeration, CVE correlation, and risk-based triage.

1. Detection & Initial Discovery

Using Shodan, identified an internet-exposed MikroTik device with two services accessible from the public internet. The Bandwidth-Test server is know to be targeted and the L2TP service can be leveraged for brute-force or tunneling attacks if misconfigured.

Evidence - Shodan

Indicators of Compromise (IOCs)

2. Vulnerability Correlation & Risk Assessment

The exposed Bandwidth-Test service on 2000/TCP was correlated with CVE-2018-1156, a stack buffer overflow vulnerability in MikroTik RouterOS versions prior to 6.42.7. While 1701/UDP L2TP is not directly tied to this CVE, its public exposure expands the attack surface and is commonly abused for DoS or credential attacks.

Evidence - NIST NVD

Primary CVE Technical Details

3. Analyst Verdict & Remediation Plan

Verdict: Confirmed high-severity risk due to CVE_2018-1156 on the exposed Bandwidth-Test service. An authenticated attacker can achieve remote code execution. The additional exposure of L2TP on 1701/UDP represents unnecessary attack surface and should be reviewed for hardening.

Recommended Immediate Actions:

1. Patch: Upgrade RouterOS to version 6.42.7 or later to remediate CVE-2018-1156.
2. Harden: Disable the Bandwidth-Test server if not required: /tool bandwidth-server set enabled=no
3. Restrict: Limit L2TP 1701/UDP acces with firewall rules to known VPN peers only.Disable if unused.
4. Audit: Review all exposed services and close unnecessary ports at the perimeter.

4. Skills & Methodologies Demonstrated

OSINT & Threat Hunting Shodan Querying Service Enumeration CVE & CVSS Analysis NIST NVD Research Attack Surface Analysis Risk-Based Triage Technical Writing Remediation Planning

Tools Used

• Shodan.io: Attack surface discovery and service enumeration
• NIST NVD: Authoritative vulnerability and risk scoring data

---

This repository is part of a cybersecurity portfolio demonstrating practical L1 SOC skills.