Mikrotik Routeros vulnerabilities

CVE-2021-36614 [MEDIUM] CWE-476 CVE-2021-36614: Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-c Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2021-36613 [MEDIUM] CWE-476 CVE-2021-36613: Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp pro Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20225 [MEDIUM] CWE-617 CVE-2020-20225: Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the / Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.

CVE-2020-20217 [MEDIUM] CWE-400 CVE-2020-20217: Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulner Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

CVE-2020-20219 [MEDIUM] CWE-787 CVE-2020-20219: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nov Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/igmp-proxy process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20212 [MEDIUM] CWE-476 CVE-2020-20212: Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nov Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20215 [MEDIUM] CWE-787 CVE-2020-20215: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nov Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access.

CVE-2020-20220 [MEDIUM] CWE-119 CVE-2020-20220: Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/b Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20266 [MEDIUM] CWE-476 CVE-2020-20266: Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /n Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20264 [MEDIUM] CWE-369 CVE-2020-20264: Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch proces Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.

CVE-2020-20254 [MEDIUM] CWE-787 CVE-2020-20254: Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /n Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20253 [MEDIUM] CWE-369 CVE-2020-20253: Mikrotik RouterOs before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nov Mikrotik RouterOs before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.

CVE-2020-20231 [MEDIUM] CWE-476 CVE-2020-20231: Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in th Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20230 [MEDIUM] CWE-400 CVE-2020-20230: Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd p Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

CVE-2020-20248 [MEDIUM] CWE-400 CVE-2020-20248: Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtes Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

CVE-2020-20252 [MEDIUM] CWE-476 CVE-2020-20252: Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the / Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20216 [MEDIUM] CWE-476 CVE-2020-20216: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nov Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

CVE-2020-20247 [MEDIUM] CWE-787 CVE-2020-20247: Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due via the loop counter variable.

CVE-2023-41570 [MEDIUM] CWE-284 CVE-2023-41570: MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in plac MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.

CVE-2015-2350 [MEDIUM] CWE-352 CVE-2015-2350: Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote a Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg.