60
CVE-2019-3977
—CVSS 3.1
7.5 high
EPSS
1%p63
Published
()
Modified
Description
RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.
- Vendors
- mikrotik
- Products
- routeros
- Weakness
- CWE-494
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N