T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:37
- Finding
- Router Credentials and Administrative Traffic Transmitted over an Unencrypted API Connection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 37-47 **Vulnerability Type**: Plaintext transmission of sensitive credentials and administrative traffic **Risk Level**: High ### Vulnerable Code ```python conn = routeros_api.RouterOsApiPool( host=host, username=username, password=password, plaintext_login=True, # Required for RouterOS 6.43+ port=8728 # Use 8729 for SSL ) api = conn.get_api() # ... do work ... conn.disconnect() ``` ### Technical Analysis The primary connection example uses RouterOS API port 8728 without transport encryption. The `plaintext_login=True` setting does not itself require an unencrypted transport, but combining it with port 8728 means that credentials and subsequent privileged RouterOS API traffic can traverse the network without TLS protection. Because this Skill is intended to perform sensitive router-management operations, intercepted traffic may contain administrator credentials, network topology, firewall policy, VPN configuration, user information, and configuration commands. An on-path attacker may also be able to alter requests or responses. The connection is necessary for the declared router-management functionality, but an unencrypted connection is not the minimum-risk implementation. TLS on port 8729 should be the default. ### Attack Path 1. A user or Agent follows the documented default connection example. 2. The Agent reads the router username and password from environment variables or user input. 3. The Agent connects to the router over the unencrypted RouterOS API port 8728. 4. An attacker positioned on the same network segment, a compromised gateway, or another on-path location captures or modifies the API traffic. 5. The attacker recovers reusable router credentials or modifies administrative commands. 6. The attacker authenticates to the router and performs operations permitted by the compromised account. ### Impact Assessment If a privileged RouterO ...[truncated 614 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make TLS-protected RouterOS API port 8729 the mandatory default. 2. Remove port 8728 from general-purpose examples or clearly restrict it to explicitly approved, isolated test environments. 3. Require certificate and hostname verification. 4. Refuse to transmit credentials when transport encryption is unavailable unless the user explicitly acknowledges the risk. 5. Use a dedicated RouterOS account with only the policy permissions needed for the requested operation. 6. Avoid broad administrator accounts for monitoring or read-only tasks. 7. Document secure certificate provisioning and trust-store configuration. 8. Ensure connections are always terminated in a `finally` block or context manager. ]]>