Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-3977

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remot

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tenable

Description

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a MikroTik RouterOS

  • RouterOS 6.45.6 Stable and below. RouterOS 6.44.5 Long-term and below.affected

References