CVE-2019-3943: vulnerability in MikroTik RouterOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 3.7%
MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files outside of the sandbox directory (/rw/disk).
Affected products
MikroTik · RouterOSRelated CVEs — MikroTik RouterOS
In the same product, most dangerous first.
CVE-2023-30800HIGHMikroTik RouterOS Web Interface Heap CorruptionEPSS 1.7%CVE-2023-30799CRITICALMikroTik RouterOS Administrator Privilege EscalationEPSS 1.4%CVE-2025-10948HIGHMikroTik RouterOS libjson.so print parse_json_element buffer overflowEPSS 1.0%CVE-2026-84411CRITICALMikroTik RouterOS Integer UnderflowEPSS 0.9%CVE-2025-6563MEDIUMCross-site scripting via dst parameter in RouterOS WiFi hotspotEPSS 0.7%CVE-2026-89028HIGHMikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndXEPSS 0.6%