CVE-2015-2350

Summary

Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg.

Impact & exploitability

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products we track (1)

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

• NVD record
• http://www.securityfocus.com/bid/73013
• http://packetstormsecurity.com/files/130722/MikroTik-RouterOS-Cross-Site-Request-Forgery.htmlExploit
• http://seclists.org/fulldisclosure/2015/Mar/49Exploit