Unscored severity · published Mar 19, 2015
CVE-2015-2350
Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Routeros · Mikrotik
through 5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2350
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2350
Exploit
http://packetstormsecurity.com/files/130722/MikroTik-RouterOS-Cross-Site-Request-Forgery.html
Exploit
http://seclists.org/fulldisclosure/2015/Mar/49
www.securityfocus.com
http://www.securityfocus.com/bid/73013
More from Routeros
9.8
CVE-2026-86060
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
9.8
CVE-2018-7445
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
9.1
CVE-2018-14847
MikroTik Router OS Directory Traversal Vulnerability
8.2
CVE-2026-67277
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
6.5
CVE-2026-67279
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS