CVE-2019-3978 Server-side request forgery in MikroTik RouterOS
Remote attackers can trigger DNS queries to arbitrary servers via port 8291, potentially poisoning the router's DNS cache.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3978?
CVE-2019-3978 is a high-severity server-side request forgery vulnerability in Mikrotik Routeros, published on 28 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning
Weakness: CWE-306
Which versions are affected by CVE-2019-3978?
It affects 1 product.
Products include Mikrotik Routeros.
How do I fix CVE-2019-3978?
No fix has been published for CVE-2019-3978 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2019-3978 being exploited?
There is no known exploitation of CVE-2019-3978 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Mikrotik Routeros
- CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer Overflow
- CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command
- CVE-2018-14847 MikroTik Router OS Directory Traversal
- CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function
- CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow
Sources
Also known as GHSA-3m56-p87c-39jp.