CVE-2019-3924

MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for general network scanning activities.
Confused Deputy
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
tenableCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
VendorProductVersion
mikrotikrouteros
𝑥
< 6.42.12
mikrotikrouteros
𝑥
< 6.43.12
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/107177
https://www.exploit-db.com/exploits/46444/
https://www.tenable.com/security/research/tra-2019-07
http://www.securityfocus.com/bid/107177
https://www.exploit-db.com/exploits/46444/
https://www.tenable.com/security/research/tra-2019-07