CVE-2018-1157

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to 6.42.7 Mikrotik RouterOS versions prior to 6.40.9

Description The issue is related to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and, in some cases, reboot the system by sending a crafted HTTP POST request. The vulnerability can be exploited via the "/jsproxy/upload" API endpoint, allowing a remote attacker to cause a denial of service or reboot the device by uploading a file that exhausts available memory.

Recommendations For versions prior to 6.42.7, update to version 6.42.7 or later. For versions prior to 6.40.9, update to version 6.40.9 or later. As a temporary workaround, consider restricting access to the /jsproxy/upload API endpoint to minimize the risk of exploitation.