PT-2017-4232 · Mikrotik · Routeros+1

Published 2017-10-14 · Updated 2025-05-14 · CVE-2017-20149

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to Stable 6.38.5 Mikrotik RouterOS versions prior to Long-term 6.37.5

Description The issue is related to memory corruption in the Mikrotik RouterOS web server. A remote and unauthenticated user can trigger the issue by sending a crafted HTTP request. This can allow an attacker to execute arbitrary code on the affected system. The issue has been exploited in the wild in mid-2017 and later.

Recommendations For versions prior to Stable 6.38.5, update to Stable 6.38.5 or later. For versions prior to Long-term 6.37.5, update to Long-term 6.37.5 or later. As a temporary workaround, consider restricting access to the web server until a patch is applied.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-07431

CVE-2017-20149

Affected Products

Mikrotik Routeros

Routeros

References · 7

• 🔥 https://github.com/BigNerd95/Chimay-Red · Exploit
• 🔥 https://bleepingcomputer.com/news/security/hajime-botnet-makes-a-comeback-with-massive-scan-for-mikrotik-routers · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-20149 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20149 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07431 · Security Note
• https://t.me/cvenotify/122135 · Telegram Post
• https://t.me/cibsecurity/51523 · Telegram Post