PT-2019-4066 · Mikrotik · Routeros+1

Published 2019-09-11 · Updated 2021-11-03 · CVE-2019-3976

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RouterOS versions 6.45.6 and earlier RouterOS versions 6.44.5 and earlier

Description The issue is related to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package, a directory could be created and the developer shell could be enabled. This vulnerability is also related to the implementation of the .NPK file processing mechanism in RouterOS, which is associated with bypassing relative paths. Exploitation of the vulnerability may allow a remote attacker to create arbitrary directories and execute arbitrary shell code using a malicious update package.

Recommendations For RouterOS versions 6.45.6 and earlier, consider disabling the package installation feature until a patch is available. For RouterOS versions 6.44.5 and earlier, restrict access to the upgrade package's name field to minimize the risk of exploitation. As a temporary workaround, consider disabling the developer shell until a patch is available.

Fix

Relative Path Traversal

RCE

Path traversal

Weakness Enumeration

CWE-23

CWE-20

CWE-22

Related Identifiers

BDU:2019-04627

CVE-2019-3976

Affected Products

Mikrotik Routeros

Routeros

References · 6

• https://bdu.fstec.ru/vul/2019-04627 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3976 · Security Note
• https://tenable.com/security/research/tra-2019-46 · Note
• https://blog.mikrotik.com/security/package-validation-and-upgrade-vulnerability.html · Note
• https://t.me/cybershit/608 · Telegram Post