{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-08-22T00:00:00", "descriptions": [{"lang": "en", "value": "Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-07-23T19:06:12", "orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.tenable.com/security/research/tra-2018-21"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://mikrotik.com/download/changelogs"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://mikrotik.com/download/changelogs/bugfix-release-tree"}, {"name": "20190723 Two vulnerabilities found in MikroTik's RouterOS", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2019/Jul/20"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "DATE_PUBLIC": "2018-08-22T00:00:00", "ID": "CVE-2018-1157", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.tenable.com/security/research/tra-2018-21", "refsource": "MISC", "url": "https://www.tenable.com/security/research/tra-2018-21"}, {"name": "https://mikrotik.com/download/changelogs", "refsource": "CONFIRM", "url": "https://mikrotik.com/download/changelogs"}, {"name": "https://mikrotik.com/download/changelogs/bugfix-release-tree", "refsource": "CONFIRM", "url": "https://mikrotik.com/download/changelogs/bugfix-release-tree"}, {"name": "20190723 Two vulnerabilities found in MikroTik's RouterOS", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2019/Jul/20"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:51:48.894Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.tenable.com/security/research/tra-2018-21"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://mikrotik.com/download/changelogs"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://mikrotik.com/download/changelogs/bugfix-release-tree"}, {"name": "20190723 Two vulnerabilities found in MikroTik's RouterOS", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2019/Jul/20"}]}]}, "cveMetadata": {"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "assignerShortName": "tenable", "cveId": "CVE-2018-1157", "datePublished": "2018-08-23T19:00:00Z", "dateReserved": "2017-12-05T00:00:00", "dateUpdated": "2024-09-17T02:56:35.170Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:ltr:*:*:*", "matchCriteriaId": "61E0FC57-8604-4BA5-BF68-A46946C3B14E", "versionEndExcluding": "6.40.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "matchCriteriaId": "79B4AC99-9E5F-480A-9884-D52271D2BC34", "versionEndExcluding": "6.42.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request."}, {"lang": "es", "value": "Mikrotik RouterOS en versiones anteriores a la 6.42.7 y 6.40.9 es vulnerable a una vulnerabilidad de agotamiento de memoria. Un atacante remoto autenticado puede provocar el cierre inesperado del servidor HTTP y, en algunas circunstancias, el reinicio del sistema mediante una petici\u00f3n POST HTTP manipulada."}], "id": "CVE-2018-1157", "lastModified": "2024-11-21T03:59:18.190", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 6.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2018-08-23T19:29:00.457", "references": [{"source": "[email protected]", "url": "http://seclists.org/fulldisclosure/2019/Jul/20"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://mikrotik.com/download/changelogs"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://mikrotik.com/download/changelogs/bugfix-release-tree"}, {"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.tenable.com/security/research/tra-2018-21"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2019/Jul/20"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mikrotik.com/download/changelogs"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mikrotik.com/download/changelogs/bugfix-release-tree"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.tenable.com/security/research/tra-2018-21"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "[email protected]", "type": "Primary"}]}

{}