LiveActive security incident?Get immediate response
CVE Record

CVE-2020-20021: An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via m...

An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE describes a denial-of-service issue affecting MikroTik Router v6.46.3 and earlier through the SSH daemon. The bundle does not provide CVSS, CWE, patch details, or confirmed affected CPEs. Business impact is mainly loss of router management or service availability if exposed systems are vulnerable.

Executive priority

Treat this as a targeted availability risk until vendor remediation is confirmed. Prioritize externally reachable MikroTik routers and business-critical network paths, but avoid claiming active exploitation based on this bundle.

Technical view

The public description attributes CVE-2020-20021 to a misconfiguration in the SSH daemon on MikroTik Router v6.46.3 and earlier, resulting in denial of service. The only referenced third-party source is Exploit-DB. The bundle does not provide root cause detail, attack prerequisites, vulnerable configuration specifics, or remediation version data.

Likely exposure

Potentially exposed organizations are those operating MikroTik Router devices at v6.46.3 or earlier, especially where SSH management is reachable from untrusted networks. The source bundle does not provide verified CPEs or inventory identifiers.

Exploitation context

The CVE references an Exploit-DB entry, indicating public exploit information exists. KEV is false, and the provided bundle contains no cited evidence of active exploitation in the wild.

Researcher notes

Evidence is thin: no CVSS, CWE, CPEs, patch version, or detailed advisory is included. Use the CVE record and Exploit-DB reference for provenance, but validate product naming and fixed-version guidance directly with MikroTik before closing exposure.

Mitigation direction

  • Check MikroTik guidance for fixed releases or configuration changes.
  • Inventory MikroTik Router devices and record RouterOS versions.
  • Limit SSH management reachability to trusted administrative networks.
  • Prioritize remediation for internet-exposed management interfaces.
  • Monitor vendor advisories because patch details are absent here.

Validation and detection

  • Search asset inventory for MikroTik Router devices.
  • Confirm whether any devices run v6.46.3 or earlier.
  • Check whether SSH management is exposed externally.
  • Review logs for SSH-related service instability or crashes.
  • Document remediation status and remaining exposed systems.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-20021 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
2Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.