CVE-2019-3924

MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for general network scanning activities.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

15.70% chance of exploitation in the next 30 days, 97th percentile

Published

2019-02-20

Updated

2024-09-17

Proof-of-concept exploits (3)

• https://www.tenable.com/security/research/tra-2019-07
• rhusiev-student/s6_sec_lab10★ · 2025-03-26
• rhusiev-student/s6_sec_lab50★ · 2025-05-02

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/46444

References

• CVE Record
• NVD entry

Related

• CVE-2019-3922
• CVE-2019-3925
• CVE-2019-3921
• CVE-2019-3926
• CVE-2019-3920
• CVE-2019-3927