CVE-2023-32154

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-32154
Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19797.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.zerodayinitiative.com/advisories/ZDI-23-710/ Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-710/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*
History

30 Jun 2025, 17:01

Type Values Removed Values Added
CPE cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*
References () https://www.zerodayinitiative.com/advisories/ZDI-23-710/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-710/ - Third Party Advisory
First Time Mikrotik
Mikrotik routeros

21 Nov 2024, 08:02

Type Values Removed Values Added
References () https://www.zerodayinitiative.com/advisories/ZDI-23-710/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-710/ -

18 Sep 2024, 19:15

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de ejecución remota de código de escritura fuera de los límites de Mikrotik RouterOS RADVD. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en instalaciones afectadas de Mikrotik RouterOS. No se requiere autenticación para aprovechar esta vulnerabilidad. La falla específica existe dentro del demonio de publicidad del enrutador. El problema se debe a la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de la raíz. Era ZDI-CAN-19797.
Summary (en) Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19797. (en) Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19797.

03 May 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 02:15

Updated : 2025-06-30 17:01

NVD link : CVE-2023-32154

Mitre link : CVE-2023-32154

CVE.ORG link : CVE-2023-32154

JSON object : View

Products Affected

mikrotik

  • routeros
CWE
CWE-787

Out-of-bounds Write