PT-2022-5757 · Mikrotik · Routeros+1

Published 2022-07-29 · Updated 2026-03-07 · CVE-2022-45315

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOs versions prior to stable v7.6

Description The issue is related to an out-of-bounds read in the snmp process, allowing attackers to execute arbitrary code via a crafted packet. This is due to a buffer overflow vulnerability when handling the u32 id key. The vulnerability can be exploited by sending specially crafted packets, enabling remote attackers to execute arbitrary code.

Recommendations For versions prior to stable v7.6, update to stable v7.6 or later to resolve the issue. As a temporary workaround, consider disabling the SNMP process until a patch is available. Restrict access to the SNMP module to minimize the risk of exploitation. Avoid using the u32 id key in the affected SNMP process until the issue is resolved.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-07156

CVE-2022-45315

Affected Products

Mikrotik Routeros

Routeros

References · 11

• 🔥 https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2022-45315/README.md · Exploit
• 🔥 https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/vul_snmp/README.md · Exploit
• 🔥 https://github.com/cq674350529/pocs_slides/tree/master/advisory/MikroTik/CVE-2022-45315 · Exploit
• https://osv.dev/vulnerability/CVE-2022-45315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45315 · Security Note
• https://bdu.fstec.ru/vul/2022-07156 · Security Note
• https://t.me/cvenotify/39297 · Telegram Post
• https://t.me/freedomf0x/18567 · Telegram Post
• https://t.me/cibsecurity/53977 · Telegram Post
• https://t.me/cybersecuritytechnologies/7314 · Telegram Post
• https://t.me/pentestingnews/30910 · Telegram Post