CVE-2019-3977

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.

RouterOS versión 6.45.6 Stable, RouterOS versión 6.44.5 Long-Term y anteriores, comprueban insuficientemente desde dónde se descargan los paquetes de actualización cuando se usa la funcionalidad autoupgrade. Por lo tanto, un atacante remoto puede engañar al router para un "upgrading" a una versión anterior de RouterOS y posiblemente restablezca todos los nombres de usuario y contraseñas del sistema.