T09 · Insecure Skill Coding Practices
- Location
client.py:29- Finding
Router Administrator Credentials Are Transmitted Without TLS
- Content
View full analysis
Vulnerability Details
File Location:
client.py:29-32andclient.py:182-193
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: HighVulnerable Code
python def connect(self): """Establish connection to RouterOS""" try: self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) self.sock.settimeout(self.timeout) self.sock.connect((self.host, self.port)) self.sock.setblocking(0) # Non-blocking mode (select handles timeout) return Truepython def login(self): """Login to RouterOS""" if not self.sock: return False try: # Send login command self._send_word('/login') self._send_word(f'=name={self.username}') self._send_word(f'=password={self.password}') self._send_word('') # End markerTechnical Analysis
The client always constructs a standard TCP socket. It never wraps that socket with Python's
sslmodule, creates anSSLContext, validates a server certificate, or performs a TLS handshake.The username and password are then serialized directly into RouterOS API words and sent over this socket. On the default RouterOS API port 8728, these values are therefore transmitted without transport encryption.
Selecting port 8729 does not make the connection secure because the implementation still uses an ordinary TCP socket. This also conflicts with the SSL support claimed in
README.md. A genuine RouterOS API-SSL endpoint will expect a TLS handshake rather than the plaintext API words sent by this implementation.Attack Path
- A user connects to a RouterOS device using the default port 8728.
- The client opens a plaintext TCP connection.
- The client sends the configured username and password in RouterOS API sentences.
- An attacker with access to the same network, a compromised gateway, or another ...[truncated 958 chars]
- Remediation
View remediation
Remediation Suggestions
- Implement RouterOS API-SSL using
ssl.create_default_context()andSSLContext.wrap_socket(). - Validate the server certificate and hostname by default.
- Allow a private certificate authority to be configured for privately managed routers.
- Make encrypted transport the default and reject plaintext authentication unless the user explicitly enables an insecure compatibility option.
- Do not infer TLS solely from port 8729; use an explicit transport-security setting.
- Clearly warn users when plaintext port 8728 is selected.
- Update the README so its SSL claims match the actual implementation.
- Add integration tests that confirm a TLS handshake occurs and invalid or untrusted certificates are rejected.
- Implement RouterOS API-SSL using