CVE-2019-3977

CVSS 3.1: 7.5 high
EPSS: 1%p63
Published: Oct 29, 2019 · Oct 29, 2019
Modified: Jun 17, 2026

Analyze CVE-2019-3977 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.

Vendors: mikrotik

Products: routeros

Weakness: CWE-494

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news

1 story

Over 300,000 MikroTik Devices Found Vulnerable to Remote Hacking Bugs

The Hacker NewsDec 10, 11:53 UTC · Dec 10, 2021VulnerabilityCVE-2018-14847 CVE-2019-3977 CVE-2019-3978+35 · 1 read