CVE-2021-36613

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2022/Jun/2Exploit, Mailing List, Patch, Third Party Advisory
https://seclists.org/fulldisclosure/2021/Jul/0Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/2Exploit, Mailing List, Patch, Third Party Advisory
https://seclists.org/fulldisclosure/2021/Jul/0Exploit, Mailing List, Third Party Advisory

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-366146.5Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote a CVE-2021-36625.4Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS).CVE-2021-366218.1Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-ba CVE-2021-366229.8Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. The admin panel has an upload CVE-2021-366239.8Arbitrary File Upload in Sourcecodester Phone Shop Sales Management System 1.0 enables RCE.CVE-2021-366249.8Sourcecodester Phone Shop Sales Managements System version 1.0 suffers from a remote SQL injection vulnerability that allows for authenticat CVE-2021-366258.8An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in CVE-2021-36637.5firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts CVE-2021-366307.5DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform D CVE-2021-366316.7Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL i CVE-2021-36645.3url-parse is vulnerable to URL Redirection to Untrusted Site CVE-2021-366466.1A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page.