Multiple vulnerabilities in MikroTik RouterOS
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | N/A |
| CWE-ID | CWE-400 CWE-119 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
MikroTik RouterOS Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | MikroTik |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Resource exhaustion
EUVDB-ID: #VU27707
Risk: Low
CVSSv3.1:
CVE-ID: N/A
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to the cerm process does not properly control consumption of internal resources. A remote authenticated user can send a specially crafted packet that triggers high CPU load and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMikroTik RouterOS: 6.45 - 6.46.3
Fixed software versionsCPE2.3 External links
http://seclists.org/fulldisclosure/2020/May/30
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
2) Memory corruption
EUVDB-ID: #VU27708
Risk: Low
CVSSv3.1:
CVE-ID: N/A
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the tracroute process. A remote authenticated user can send a specially crafted packet to create to the service, trigger memory corruption and crash the traceroute process.
Install updates from vendor's website.
Vulnerable software versionsMikroTik RouterOS: 6.46 - 6.46.4
Fixed software versionsCPE2.3 External links
http://seclists.org/fulldisclosure/2020/May/30
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
