CVE-2019-15055: MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files…

PriorityP341medium6.5CVSS 3.0

AVNACLPRLUINSUCNIHAN

EPSS

2.23%

80.6th percentile

MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mikrotik	routeros	<= 6.44.5	—
mikrotik	routeros	6.45 – 6.45.3	—

CVSS provenance

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.