CVE-2019-13955: Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion.

Security readout for executives and security teams

This issue can let an authenticated remote attacker crash the MikroTik RouterOS HTTP server by sending a crafted request. The sources state malicious code cannot be injected. Business urgency is mainly service availability and management-plane stability, especially where router administration is reachable beyond trusted administrators. Exposure is likely limited to MikroTik RouterOS long-term installations before 6.44.5 with the HTTP management service reachable to authenticated users. Internet-exposed or broadly reachable management interfaces increase operational risk. Treat this as a moderate availability risk for MikroTik router management planes. Prioritize remediation for exposed or shared-administration environments, but the provided evidence does not support emergency treatment as code execution or confirmed active exploitation. Mitigation focus: Upgrade affected RouterOS long-term systems to 6.44.5 or later.; Review MikroTik vendor guidance for confirmed fixed releases.; Restrict HTTP management access to trusted administrative networks..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.