CVE-2017-20149

The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on the affected system, as exploited in the wild in mid-2017 and later.

• CWE-787
• CWE-787

• https://github.com/BigNerd95/Chimay-RedExploit, Third Party Advisory
• https://www.bleepingcomputer.com/news/security/hajime-botnet-makes-a-comeback-with-massive-scan-for-mikrotik-routers/Exploit, Third Party Advisory
• https://github.com/BigNerd95/Chimay-RedExploit, Third Party Advisory
• https://www.bleepingcomputer.com/news/security/hajime-botnet-makes-a-comeback-with-massive-scan-for-mikrotik-routers/Exploit, Third Party Advisory

Published

Oct 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-20143A vulnerability, which was classified as critical, has been …9.8
• CVE-2017-20144A vulnerability has been found in Anvsoft PDFMate PDF Conver…7.8
• CVE-2017-20145A vulnerability was found in Tecrail Responsive Filemanger u…9.8
• CVE-2017-20146Usage of the CORS handler may apply improper CORS headers, a…9.8
• CVE-2017-20147In the ebuild package through smokeping-2.7.3-r1 for SmokePi…6.5
• CVE-2017-20148In the ebuild package through logcheck-1.3.23.ebuild for Log…9.8
• CVE-2017-2015Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-20150A vulnerability was found in challenge website. It has been …8.8
• CVE-2017-20151A vulnerability classified as problematic was found in iText…9.8
• CVE-2017-20152A vulnerability, which was classified as problematic, was fo…7.5
• CVE-2017-20153A vulnerability has been found in aerouk imageserve and clas…6.1
• CVE-2017-20154A vulnerability was found in ghostlander Phoenixcoin. It has…7.5