CVE-2019-3976

2019-10-2821:32:40

CWE-23

tenable

www.cve.org

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

47.8%

JSON

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package’s name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled.

CNA Affected

[
  {
    "product": "MikroTik RouterOS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "RouterOS 6.45.6 Stable and below. RouterOS 6.44.5 Long-term and below."
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2019-46