Directory Creation Vulnerability in RouterOS by MikroTik
CVE-2019-3976

8.8HIGH

Key Information:

Vendor

Mikrotik

Status
Mikrotik Routeros
Vendor
CVE Published:
29 October 2019

What is CVE-2019-3976?

MikroTik's RouterOS versions 6.45.6 and 6.44.5 are susceptible to an arbitrary directory creation vulnerability. This issue arises when an authenticated user installs a malicious upgrade package. Specifically, the vulnerability exploits the name field of the package, allowing attackers to create arbitrary directories, which could enable the developer shell. This might facilitate unauthorized access and subsequent exploitation of the affected system.

Affected Version(s)

MikroTik RouterOS RouterOS 6.45.6 Stable and below. RouterOS 6.44.5 Long-term and below.

References

https://www.tenable.com/security/research/tra-2019-46
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.