Arbitrary directory creation in RouterOS

What is the CVE-2019-3976 vulnerability?

The vulnerability allows the creation of an arbitrary directory via the package name field in the update package. If an authenticated user installs a malicious package, they can create a directory and enable the developer shell.

Which RouterOS versions are vulnerable?

RouterOS 6.45.6 Stable and earlier versions, and RouterOS 6.44.5 Long-term and earlier versions, are vulnerable. The fixed version has not yet been announced.

Is my router at risk?

A router is exposed if it is running one of the indicated vulnerable versions and if a user with access credentials can install packages. Since the involved services are not specified, the risk depends on the attacker’s ability to authenticate and manage system updates.

Is the CVE-2019-3976 vulnerability actively exploited?

As of the date of the article, the vulnerability is not listed in the CISA KEV catalog nor reported as exploited by ENISA.

How to protect the router from CVE-2019-3976?

Update RouterOS to a version later than 6.45.6 Stable and 6.44.5 Long-term. While waiting for the update, restrict administrative access to trusted networks only and monitor for the installation of unauthorized packages.

Which RouterOS commands are needed to mitigate CVE-2019-3976?

Update RouterOS

The only definitive fix is the update. First, save the configuration; the installation will reboot the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Official sources

• https://www.tenable.com/security/research/tra-2019-46
• https://www.tenable.com/security/research/tra-2019-46