CVE-2019-3943

MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files outside of the sandbox directory (/rw/disk).

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:S/C:C/I:P/A:N

EPSS

3.67% chance of exploitation in the next 30 days, 89th percentile

Published

2019-04-10

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.tenable.com/security/research/tra-2019-16

References

• CVE Record
• NVD entry

Related

• CVE-2019-3938
• CVE-2019-3946
• CVE-2019-3937
• CVE-2019-3947
• CVE-2019-3935
• CVE-2019-3948