High severity · published Aug 5, 2020
CVE-2020-17366
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1
7.4
CVSS
0.7%
EPSS
No
On KEV
Description
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate Revocation List files from the RPKI relying party's view.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Routinator · Nlnetlabs
0.1.0 through 0.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-17366
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-17366
Exploit
https://github.com/NLnetLabs/routinator/issues/319
Release Notes
https://github.com/NLnetLabs/routinator/releases/tag/v0.8.0
More from Routinator
7.5
CVE-2026-49235
Routinator crashes on specifically crafted RRDP XML files
7.5
CVE-2026-49234
Routinator crashes on specifically crafted ASN strings in the API
7.5
CVE-2026-49233
Routinator cache path traversal using rogue rsync URIs
7.5
CVE-2024-1622
Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening
7.5
CVE-2023-39915
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects