CVE-2019-3977

CVE-2019-3977 affects MikroTik RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and earlier, stemming from insufficient validation of upgrade package sources during autoupgrade. This allows a remote attacker to trick the router into downgrading to an older version, potentially resetting all system usernames and passwords. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, leading to high integrity impact. While there is no known exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation, though it is not currently listed on the KEV catalog.