CVE-2019-3981: mikrotik routeros Channel Accessible by Non-Endpoint

Vulnerability summary

CVE-2019-3981 is a medium (CVSS 4.3) Channel Accessible by Non-Endpoint vulnerability in mikrotik routeros. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-01-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed password.

• CWE-300Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.