PT-2021-10452 · Mikrotik · Mikrotik Routeros

Cq674350529 + 1 · Published 2021-05-18 · Updated 2022-05-03 · CVE-2020-20227

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOs version 6.47

Description: The issue is related to a memory corruption problem in the /nova/bin/diskd process. It can be exploited by an authenticated remote attacker to cause a Denial of Service due to invalid memory access.

Recommendations: For Mikrotik RouterOs version 6.47, consider restricting access to the /nova/bin/diskd process until a patch is available. As a temporary workaround, monitor the system for signs of invalid memory access and Denial of Service conditions to minimize the impact of potential exploitation.

Exploit

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-20227

Affected Products

Mikrotik Routeros

References · 5

• 🔥 http://packetstormsecurity.com/files/162533/MikroTik-RouterOS-Memory-Corruption.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2021/May/23 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-20227 · Security Note
• https://osv.dev/vulnerability/CVE-2020-20227 · Vendor Advisory
• https://mikrotik.com · Note