CVE-2018-1158

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to 6.42.7 Mikrotik RouterOS versions prior to 6.40.9

Description The issue is related to a stack exhaustion vulnerability in the HTTP server of the RouterOS operating system. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. This can be achieved by sending a specially crafted request to the server.

Recommendations For versions prior to 6.42.7, update to version 6.42.7 or later to resolve the issue. For versions prior to 6.40.9, update to version 6.40.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP server to minimize the risk of exploitation.