CVE-2023-30800

The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

1.70% chance of exploitation in the next 30 days, 76th percentile

Published

2023-09-07

Updated

2025-11-21

Proof-of-concept exploits (4)

• KhogenTheRabbit/cve-2023-30800-multithread-doser1★ · 2024-09-06
• diemaxxing/cve-2023-30800-multithread-doser1★ · 2024-09-06
• griffinsectio/CVE-2023-30800_PoC0★ · 2024-07-17
• griffinsectio/CVE-2023-30800_PoC_go0★ · 2024-07-23

References

• CVE Record
• NVD entry

Related

• CVE-2023-30799
• CVE-2023-30802
• CVE-2023-30790
• CVE-2023-30803
• CVE-2023-3079
• CVE-2023-30804