CVE-2023-30800CWE-787

MikroTik RouterOS Web Interface Heap Corruption

High · published September 7, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
76.8
In the wild
Unconfirmed
What it is

The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01687 · 76.8th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2023-09-07T15:43Z
EPSS history
Timeline
  • 07 SEP 15:43Z
    MikroTik RouterOS Web Interface Heap Corruption
    cvelistv5