CVE-2023-30800: MikroTik RouterOS Web Interface Heap Corruption

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-30800.

Q: What is the severity of CVE-2023-30800?

CVE-2023-30800 has a severity rating of 7.5, which is considered high.

Q: How does CVE-2023-30800 affect MikroTik RouterOS?

CVE-2023-30800 affects MikroTik RouterOS version 6.

Q: What is the impact of CVE-2023-30800?

CVE-2023-30800 allows a remote and unauthenticated attacker to corrupt the server's heap memory, causing the web interface to crash and immediately restart.

Q: Has CVE-2023-30800 been fixed?

Yes, CVE-2023-30800 has been fixed in MikroTik RouterOS version 6.49.10 and later.

Published Sep 7, 2023

Updated

The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.

Affected Software

1 affected component

Mikrotik RouterOS>=6.0<6.49.10

Event History

Sep 7, 2023

CVE Published

via MITRE·03:43 PM

Data Sourced

via MITRE·03:43 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-30800.

What is the severity of CVE-2023-30800?

CVE-2023-30800 has a severity rating of 7.5, which is considered high.

How does CVE-2023-30800 affect MikroTik RouterOS?

CVE-2023-30800 affects MikroTik RouterOS version 6.

What is the impact of CVE-2023-30800?

CVE-2023-30800 allows a remote and unauthenticated attacker to corrupt the server's heap memory, causing the web interface to crash and immediately restart.

Has CVE-2023-30800 been fixed?