CVE-2019-3977CWE-494

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade…

published October 28, 2019

CVSS
—
EPSS
1%
Percentile
64.2
In the wild
Unconfirmed
What it is

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01059 · 64.2th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2019-10-28T21:34Z
EPSS history
Timeline
  • 28 OCT 21:34Z
    RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade…
    cvelistv5