Vulnerabilities > CVE-2020-20254 - Out-of-bounds Write vulnerability in Mikrotik Routeros
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- http://seclists.org/fulldisclosure/2021/May/14
- http://seclists.org/fulldisclosure/2021/May/14
- http://seclists.org/fulldisclosure/2021/May/14
- http://seclists.org/fulldisclosure/2021/May/14
- https://github.com/cq674350529/pocs_slides/blob/master/pocs/MikroTik/vul_lcdstat_2/README.md
- https://github.com/cq674350529/pocs_slides/blob/master/pocs/MikroTik/vul_lcdstat_2/README.md