RouterOS autoupgrade vulnerability

What is the CVE-2019-3977 vulnerability?

The vulnerability consists of insufficient validation of the source from which update packages are downloaded when using the autoupgrade feature. A remote attacker can trick the router into believing it is performing an upgrade, causing it to install an older version of RouterOS instead. This behavior can lead to the reset of all system users and passwords.

Which RouterOS versions are vulnerable?

RouterOS 6.45.6 Stable and earlier versions, as well as RouterOS 6.44.5 Long-term and earlier versions, are vulnerable. The fixed version has not yet been announced.

Is my router at risk?

A router is exposed if the autoupgrade feature is enabled and the device is reachable from untrusted networks. Since the involved services are not specified, the risk depends on the configuration of the automatic update feature and the router’s exposure to uncontrolled traffic.

Is the CVE-2019-3977 vulnerability actively exploited?

As of the date of the article, the vulnerability is not present in the CISA KEV catalog and is not reported as exploited by ENISA. There is no evidence of active exploitation.

How to protect the router from CVE-2019-3977?

Disable the autoupgrade feature to prevent the router from downloading packages from unverified sources. If possible, update the firmware to a version later than those listed as vulnerable. Verify that the router is not reachable from untrusted networks unless strictly necessary.

Which RouterOS commands are needed to mitigate CVE-2019-3977?

Updating RouterOS

The only definitive fix is the update. First, save the configuration; the installation will reboot the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Official sources

• https://www.tenable.com/security/research/tra-2019-46
• https://www.tenable.com/security/research/tra-2019-46