First published: Wed Jul 03 2019(Updated: )
A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource management.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
MikroTik devices | <=6.44.3 | |
Mikrotik Ccr1009-7g-1c-1s\+ | ||
Mikrotik Ccr1009-7g-1c-1s\+pc | ||
Mikrotik Ccr1009-7g-1c-pc | ||
Mikrotik Ccr1016-12g | ||
Mikrotik Ccr1016-12s-1s\+ | ||
Mikrotik Ccr1036-12g-4s | ||
Mikrotik Ccr1036-12g-4s-em | ||
Mikrotik Ccr1036-8g-2s\+ | ||
Mikrotik Ccr1036-8g-2s\+em | ||
Mikrotik Ccr1072-1g-8s\+ | ||
Mikrotik Hex | ||
Mikrotik Hex Lite | ||
Mikrotik Hex Poe | ||
Mikrotik Hex Poe Lite | ||
Mikrotik Hex S | ||
Mikrotik Powerbox | ||
Mikrotik Powerbox Pro | ||
Mikrotik Rb1100ahx4 | ||
Mikrotik Rb1100ahx4 | ||
Mikrotik Rb2011il-in | ||
Mikrotik Rb2011il-rm | ||
Mikrotik Rb2011ils-in | ||
Mikrotik Rb2011uias-in | ||
Mikrotik Rb2011uias-rm | ||
Mikrotik Rb3011uias-rm | ||
Mikrotik Rb4011igs\+rm |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2019-13074 is considered to be of high severity due to its potential to allow remote attackers to exhaust device memory.
To mitigate CVE-2019-13074, upgrade the MikroTik router to version 6.44.4 or higher that contains the necessary security patches.
CVE-2019-13074 affects MikroTik routers running RouterOS version 6.44.3 or earlier.
CVE-2019-13074 can be exploited by remote attackers through the FTP daemon to consume excessive memory resources.
As a workaround for CVE-2019-13074, disabling the FTP service on vulnerable MikroTik devices can help prevent exploitation.