Lucene search

K

54 matches found

CVE
CVE
added 2018/08/02 7:29 a.m.1581 views

CVE-2018-14847

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

9.1CVSS8.9AI score0.92843EPSS
CVE
CVE
added 2018/03/19 9:29 p.m.776 views

CVE-2018-7445

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possib...

10CVSS10AI score0.8603EPSS
CVE
CVE
added 2019/07/26 1:15 p.m.420 views

CVE-2019-13954

Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system. Malicious code cannot be injected.

6.8CVSS6.5AI score0.0092EPSS
CVE
CVE
added 2019/07/26 1:15 p.m.418 views

CVE-2019-13955

Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Malicious code cannot be injected.

6.5CVSS6.6AI score0.01025EPSS
CVE
CVE
added 2019/07/03 9:15 p.m.352 views

CVE-2019-13074

A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource management.

7.8CVSS7.5AI score0.00852EPSS
CVE
CVE
added 2023/07/19 3:15 p.m.319 views

CVE-2023-30799

MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary c...

9.1CVSS8.7AI score0.00267EPSS
CVE
CVE
added 2019/08/26 9:15 p.m.289 views

CVE-2019-15055

MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator wit...

6.5CVSS6.3AI score0.00593EPSS
CVE
CVE
added 2019/04/10 9:29 p.m.264 views

CVE-2019-3943

MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files out...

8.1CVSS8AI score0.00575EPSS
CVE
CVE
added 2019/02/20 8:29 p.m.252 views

CVE-2019-3924

MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for ...

7.5CVSS7.6AI score0.13729EPSS
CVE
CVE
added 2023/09/07 4:15 p.m.236 views

CVE-2023-30800

The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in...

7.5CVSS7.7AI score0.03172EPSS
CVE
CVE
added 2024/05/03 2:15 a.m.222 views

CVE-2023-32154

Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists with...

7.5CVSS7.9AI score0.02188EPSS
CVE
CVE
added 2019/10/29 7:15 p.m.216 views

CVE-2019-3978

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning

7.5CVSS7.6AI score0.15435EPSS
CVE
CVE
added 2022/12/05 4:15 p.m.189 views

CVE-2022-45313

Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message.

8.8CVSS8.8AI score0.04707EPSS
CVE
CVE
added 2023/11/14 11:15 p.m.178 views

CVE-2023-41570

MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.

5.3CVSS5.3AI score0.00089EPSS
CVE
CVE
added 2019/10/29 7:15 p.m.176 views

CVE-2019-3976

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled.

8.8CVSS8.5AI score0.01137EPSS
CVE
CVE
added 2022/12/05 4:15 p.m.167 views

CVE-2022-45315

Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows attackers to execute arbitrary code via a crafted packet.

9.8CVSS9.5AI score0.01334EPSS
CVE
CVE
added 2019/10/29 7:15 p.m.161 views

CVE-2019-3977

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's...

8.5CVSS8AI score0.01182EPSS
CVE
CVE
added 2023/07/12 1:15 p.m.156 views

CVE-2020-20021

An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.

7.5CVSS7.3AI score0.00089EPSS
CVE
CVE
added 2022/05/11 6:15 p.m.151 views

CVE-2021-36614

Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

6.5CVSS6.5AI score0.00334EPSS
CVE
CVE
added 2022/05/11 6:15 p.m.148 views

CVE-2021-36613

Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

6.5CVSS6.5AI score0.00334EPSS
CVE
CVE
added 2019/10/29 7:15 p.m.144 views

CVE-2019-3979

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the domain that was queried. Therefore, a remote attacker controlled DNS server can poison the router's D...

7.5CVSS7.5AI score0.00261EPSS
CVE
CVE
added 2025/02/11 11:15 p.m.141 views

CVE-2024-54772

An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with ...

5.4CVSS5.4AI score0.02415EPSS
CVE
CVE
added 2018/08/23 7:29 p.m.135 views

CVE-2018-1157

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request.

6.8CVSS6.7AI score0.0228EPSS
CVE
CVE
added 2022/08/26 6:15 p.m.135 views

CVE-2022-36522

Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

6.5CVSS6.2AI score0.00109EPSS
CVE
CVE
added 2021/07/08 12:15 p.m.132 views

CVE-2020-20217

Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

6.5CVSS6.3AI score0.01943EPSS
CVE
CVE
added 2020/03/23 4:15 p.m.131 views

CVE-2020-10364

The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management.

7.8CVSS7.5AI score0.02151EPSS
CVE
CVE
added 2020/09/14 9:15 p.m.128 views

CVE-2020-11881

An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server via modified setup-request packets, aka SUP-12964.

7.5CVSS7.5AI score0.21166EPSS
CVE
CVE
added 2020/10/07 4:15 p.m.125 views

CVE-2019-16160

An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.

7.5CVSS7.5AI score0.01761EPSS
CVE
CVE
added 2021/07/14 2:15 p.m.122 views

CVE-2020-20231

Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

6.5CVSS6.5AI score0.01006EPSS
CVE
CVE
added 2021/05/03 4:15 p.m.117 views

CVE-2020-20247

Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due via the loop counter variable.

6.5CVSS6.5AI score0.0089EPSS
CVE
CVE
added 2021/07/13 6:15 p.m.117 views

CVE-2020-20252

Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

6.5CVSS6.5AI score0.01013EPSS
CVE
CVE
added 2021/07/07 2:15 p.m.114 views

CVE-2020-20225

Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.

6.5CVSS6.2AI score0.00342EPSS
CVE
CVE
added 2021/07/21 3:15 p.m.110 views

CVE-2020-20262

Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.

6.5CVSS6.2AI score0.00347EPSS
CVE
CVE
added 2021/07/21 3:15 p.m.105 views

CVE-2020-20221

Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

6.8CVSS6.3AI score0.01525EPSS
CVE
CVE
added 2021/07/19 5:15 p.m.105 views

CVE-2020-20230

Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

6.5CVSS6.3AI score0.01215EPSS
CVE
CVE
added 2021/05/18 2:15 p.m.105 views

CVE-2020-20254

Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

6.5CVSS6.5AI score0.01194EPSS
CVE
CVE
added 2021/07/13 12:15 p.m.102 views

CVE-2020-20250

Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). NOTE: this is different from CVE-2020-20253 and CVE-2020-20254. All four vulnerabi...

6.5CVSS6.6AI score0.0136EPSS
CVE
CVE
added 2021/05/18 8:15 p.m.101 views

CVE-2020-20220

Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

6.5CVSS6.5AI score0.01439EPSS
CVE
CVE
added 2021/05/11 3:15 p.m.101 views

CVE-2020-20265

Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/nova/bin/wireless process. An authenticated remote attacker can cause a Denial of Service due via a crafted packet.

6.5CVSS6.5AI score0.00403EPSS
CVE
CVE
added 2021/05/11 3:15 p.m.101 views

CVE-2020-20267

Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/resolver process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access.

6.5CVSS6.5AI score0.0101EPSS
CVE
CVE
added 2018/08/23 7:29 p.m.100 views

CVE-2018-1156

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.

9CVSS8.7AI score0.04249EPSS
CVE
CVE
added 2021/07/19 6:15 p.m.100 views

CVE-2020-20249

Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending a crafted packet, an authenticated remote attacker can cause a Denial of Service.

6.5CVSS6.5AI score0.00311EPSS
CVE
CVE
added 2021/05/18 2:15 p.m.100 views

CVE-2020-20253

Mikrotik RouterOs before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.

6.5CVSS6.2AI score0.01194EPSS
CVE
CVE
added 2021/05/19 12:15 p.m.95 views

CVE-2020-20264

Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.

6.5CVSS6.3AI score0.01561EPSS
CVE
CVE
added 2021/05/19 12:15 p.m.95 views

CVE-2020-20266

Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

6.5CVSS6.5AI score0.01566EPSS
CVE
CVE
added 2021/01/04 7:15 p.m.81 views

CVE-2021-3014

In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.

6.1CVSS5.9AI score0.00576EPSS
CVE
CVE
added 2018/08/23 7:29 p.m.76 views

CVE-2018-1159

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting.

6.5CVSS7.5AI score0.01108EPSS
CVE
CVE
added 2022/10/15 2:15 a.m.73 views

CVE-2017-20149

The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on the...

9.8CVSS9.7AI score0.01226EPSS
CVE
CVE
added 2018/08/23 7:29 p.m.70 views

CVE-2018-1158

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.

6.5CVSS6.9AI score0.0127EPSS
CVE
CVE
added 2020/03/02 10:15 p.m.66 views

CVE-2018-5951

An issue was discovered in Mikrotik RouterOS. Crafting a packet that has a size of 1 byte and sending it to an IPv6 address of a RouterOS box with IP Protocol 97 will cause RouterOS to reboot imminently. All versions of RouterOS that supports EoIPv6 are vulnerable to this attack.

7.5CVSS7.4AI score0.15503EPSS
Total number of security vulnerabilities54