QwikSec

Security Database

CVE

CWE

Training

CVE-2019-3977

Published: Oct 28, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.

Vendor	Product	Versions
n/a	MikroTik RouterOS	affected `RouterOS 6.45.6 Stable and below. RouterOS 6.44.5 Long-term and below.`

Weaknesses (CWE)

References

https://www.tenable.com/security/research/tra-2019-46

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.