CVE-2020-20250
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). NOTE: this is different from CVE-2020-20253 and CVE-2020-20254. All four vulnerabilities in the /nova/bin/lcdstat process are discussed in the CVE-2020-20250 github.com/cq674350529 reference.
Mikrotik RouterOs versiones anteriores a estable 6.47, sufre una vulnerabilidad de corrupción de memoria en el proceso /nova/bin/lcdstat. Un atacante remoto autenticado puede causar una Denegación de Servicio (desreferencia del puntero NULL). NOTA: esto es diferente de CVE-2020-20253 y CVE-2020-20254. Las cuatro vulnerabilidades en el proceso /nova/bin/lcdstat son discutidas en la referencia CVE-2020-20250 github.com/cq674350529
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-08-13 CVE Reserved
- 2021-07-13 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-476: NULL Pointer Dereference
- CWE-787: Out-of-bounds Write
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2020-20250/README.md | 2024-08-04 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://mikrotik.com | 2022-06-28 |