Medium severity · published Aug 26, 2019
CVE-2019-15055
MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files
6.5
CVSS
2.2%
EPSS
No
On KEV
Description
MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Routeros · Mikrotik
through 6.44.5; 6.45 through 6.45.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15055
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15055
Third Party Advisory
https://fortiguard.com/zeroday/FG-VD-19-108
forum.mikrotik.com
https://forum.mikrotik.com/viewtopic.php?t=151603
Exploit
https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055
Press/Media Coverage
https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90
Release Notes
https://mikrotik.com/download/changelogs/testing-release-tree
More from Routeros
9.8
CVE-2026-86060
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
9.8
CVE-2018-7445
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
9.1
CVE-2018-14847
MikroTik Router OS Directory Traversal Vulnerability
8.2
CVE-2026-67277
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
6.5
CVE-2026-67279
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS