CVE-2019-15055 Information

Description

MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage which allows them access to the management interface as an administrator without authentication.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Reference

https://fortiguard.com/zeroday/FG-VD-19-108 https://forum.mikrotik.com/viewtopic.php?t=151603 https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055 https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90 https://mikrotik.com/download/changelogs/testing-release-tree

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

6.5