CVE-2020-5721: 
NixOS vulnerability analysis and mitigation

MikroTik WinBox 3.22 and below contains a vulnerability where the user's cleartext password is stored in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is enabled by default, and by default Master Password is not set. The vulnerability was disclosed on April 15, 2020 and is tracked as CVE-2020-5721 (NVD).

The vulnerability exists in the password storage mechanism of WinBox. When the Keep Password option is selected (which is enabled by default), the application stores the user's credentials in cleartext format in a file called settings.cfg.viw located in WinBox's AppData/Roaming directory (C:\Users\USERNAME\AppData\Roaming\Mikrotik\Winbox\settings.cfg.viw). The username and password can be found appended to the keywords 'login' and 'pwd' respectively. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Tenable Advisory).

An attacker who gains access to the configuration file can extract the username and password, which can then be used to gain unauthorized access to the router. This poses a significant security risk as the credentials are stored in plaintext format and can be easily retrieved by anyone with access to the file system (Tenable Advisory).

The vulnerability requires local access to the system where WinBox is installed to exploit. Once an attacker has access to the configuration file, they can easily extract the credentials and use them to pivot to the router (NVD).

To mitigate this issue, MikroTik recommends using WinBox's 'Set Master Password' functionality. This feature provides an additional layer of security by encrypting the stored credentials (Tenable Advisory).