A vulnerability, which was classified as critical, has been found in MikroTik RouterOS up to 6.37.4/6.38.4 (Router Operating System). This issue affects an unknown code block of the component Web Server. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on the affected system, as exploited in the wild in mid-2017 and later.

The weakness was released 10/15/2022. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2017-20149 since 10/15/2022. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 6.37.5 or 6.38.5 eliminates this vulnerability.

Productinfo

Type

• Router Operating System

Vendor

• MikroTik

Name

• RouterOS

Version

• 6.37.0
• 6.37.1
• 6.37.2
• 6.37.3
• 6.37.4
• 6.38.0
• 6.38.1
• 6.38.2
• 6.38.3
• 6.38.4

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion