High severity · published Jul 3, 2019
CVE-2019-13074
A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of…
7.5
CVSS
2%
EPSS
No
On KEV
Description
A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource management.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Routeros · Mikrotik
through 6.44.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13074
Vendor Advisory
https://forum.mikrotik.com/viewtopic.php?t=150045
Release Notes
https://mikrotik.com/download/changelogs/stable-release-tree
More from Routeros
9.8
CVE-2026-86060
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
9.8
CVE-2018-7445
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
9.1
CVE-2018-14847
MikroTik Router OS Directory Traversal Vulnerability
8.2
CVE-2026-67277
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
6.5
CVE-2026-67279
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS