CVSS 3.0
6.5 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2019-15055
Medium (6.5) in mikrotik routeros. EPSS 2.2% chance of exploitation in the next 30 days.
MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication.
Severity
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mikrotik:routeros
References
- https://fortiguard.com/zeroday/FG-VD-19-108
- https://forum.mikrotik.com/viewtopic.php?t=151603
- https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055
- https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90
- https://mikrotik.com/download/changelogs/testing-release-tree