CVE-2019-3976: MikroTik RouterOS

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled.

Affected products

• MikroTik RouterOS: up to and including 6.44.5; up to and including 6.45.6

Published 2019-10-29. Last modified 2026-06-17.