CVE-2019-15055

MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication.

CVSS v3.0 6.5 MEDIUM
CVSS v2.0 5.5 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://mikrotik.com/download/changelogs/testing-release-tree	Release Notes Vendor Advisory
https://fortiguard.com/zeroday/FG-VD-19-108	Third Party Advisory
https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055	Exploit Third Party Advisory
https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90	Press/Media Coverage Third Party Advisory
https://forum.mikrotik.com/viewtopic.php?t=151603

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:mikrotik:routeros::::::::
	cpe:2.3:o:mikrotik:routeros::::::::

Information

Published : 2019-08-26 14:15

Updated : 2020-10-06 05:15

NVD link : CVE-2019-15055

Mitre link : CVE-2019-15055

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

Products Affected

mikrotik

routeros

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://mikrotik.com/download/changelogs/testing-release-tree", "name": "https://mikrotik.com/download/changelogs/testing-release-tree", "tags": ["Release Notes", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://fortiguard.com/zeroday/FG-VD-19-108", "name": "https://fortiguard.com/zeroday/FG-VD-19-108", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055", "name": "https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90", "name": "https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90", "tags": ["Press/Media Coverage", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://forum.mikrotik.com/viewtopic.php?t=151603", "name": "https://forum.mikrotik.com/viewtopic.php?t=151603", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-15055", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}}, "publishedDate": "2019-08-26T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.45.3", "versionStartIncluding": "6.45"}, {"cpe23Uri": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.44.5"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-10-06T12:15Z"}