CVEvulnerability
CVE-2019-15055
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-08-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
- Weaknesses
- CWE-22
Description
MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication.
Affected configurations
• mikrotik routeros (<= 6.44.5)
• mikrotik routeros (>= 6.45 <= 6.45.3)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://fortiguard.com/zeroday/FG-VD-19-108 Third Party Advisory
- https://forum.mikrotik.com/viewtopic.php?t=151603 forum.mikrotik.com
- https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055 Exploit, Third Party Advisory
- https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90 Press/Media Coverage, Third Party Advisory
- https://mikrotik.com/download/changelogs/testing-release-tree Release Notes, Vendor Advisory
- https://fortiguard.com/zeroday/FG-VD-19-108 Third Party Advisory
- https://forum.mikrotik.com/viewtopic.php?t=151603 forum.mikrotik.com
- https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055 Exploit, Third Party Advisory
- https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90 Press/Media Coverage, Third Party Advisory
- https://mikrotik.com/download/changelogs/testing-release-tree Release Notes, Vendor Advisory