Strix
26.1K

CVE-2019-3943

HIGHCVSS 8.1/10EPSS 3.74%

Last modified

CVE-2019-3943 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files outside of the sandbox directory (/rw/disk).. EPSS estimates a 3.74% chance of exploitation in the next 30 days.

Description

MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files outside of the sandbox directory (/rw/disk).

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Probability
3.74%

88.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
MikrotikRouteros<= 6.42.12—
MikrotikRouteros<= 6.43.12—
MikrotikRouteros6.41Rc31
MikrotikRouteros6.42Rc11
MikrotikRouteros6.43Rc11
MikrotikRouteros6.44Beta14

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-3943?
MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files outside of the sandbox directory (/rw/disk).
How severe is CVE-2019-3943?
CVE-2019-3943 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 3.74% probability of exploitation in the next 30 days.
How do I fix CVE-2019-3943?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-3943?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST