PT-2019-3741 · Mikrotik · Routeros+1

Cq674350529 + 1 · Publicado 2019-07-24 · Atualizado 2020-08-24 · CVE-2019-13954

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to 6.44.5

Description The issue is related to memory exhaustion, where an authenticated remote attacker can crash the HTTP server and potentially reboot the system by sending a crafted HTTP request. This can lead to a denial of service. There is no mention of the estimated number of potentially affected devices or real-world incidents.

Recommendations For versions prior to 6.44.5, update to version 6.44.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP server to minimize the risk of exploitation.

Correção

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

BDU:2019-03997

CVE-2019-13954

Produtos afetados

Mikrotik Routeros

Routeros

Referências · 6

• http://packetstormsecurity.com/files/153733/Mikrotik-RouterOS-Resource-Stack-Exhaustion.html · Nota
• https://seclists.org/fulldisclosure/2019/Jul/20 · Nota
• https://osv.dev/vulnerability/CVE-2019-13954 · Aviso do Fabricante
• https://packetstormsecurity.com/files/153733/Mikrotik-RouterOS-Resource-Stack-Exhaustion.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-13954 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03997 · Nota de Segurança