CVE-2020-20212

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.16.5Medium EPSS percentile84th2.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2021-07-07Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether any MikroTik router runs RouterOS 6.44.5.
Ask your router administrator or vendor for the confirmed fixed RouterOS release; the findings do not provide an exact fixed version.
Until upgraded, remove unused router accounts and restrict management access to trusted staff and networks.
Review router logs for unexpected administrator logins or restarts.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

In plain language

Written by AI from the record

Mikrotik RouterOS 6.44.5 can be crashed by someone with a valid login, so affected businesses should have their router administrator check it soon.

Authenticated remote denial of service in the RouterOs /nova/bin/console process caused by a NULL-pointer dereference (CWE-476).

If you're affected

Internet outage
Branch connectivity disruption
Router restart required
Business service interruption

What is it

This is a flaw that can make an affected router stop working when a logged-in attacker sends it a harmful request. Think of it like a receptionist being given a bad instruction and shutting down the building’s phone switchboard: internet and network connections may be interrupted until the router is restored.

Who is affected

This matters to you if your business uses MikroTik RouterOS on its network routers. It is only a risk if an attacker already has a valid router login.

How urgent is it

An attacker with a valid login can use publicly available exploit code to disrupt the router, so address this promptly. It is not listed in CISA’s known-exploited catalog, which supports an amber—not emergency—priority.

What to do — in detail

Confirm exposure by inventorying MikroTik devices and checking their installed RouterOS release through the router management interface or your management system. The findings identify RouterOS 6.44.5 as affected, but do not provide confirmed fixed version targets for any branch; obtain the supported remediation release directly from MikroTik before scheduling the change.

Back up the router configuration, validate the upgrade on a non-critical device where possible, and apply the vendor-approved RouterOS update during a maintenance window. No breaking-change information is provided in the findings, so review the vendor release notes and confirm compatibility with your hardware and configuration.

If patching is delayed, limit router management services to a dedicated administration network or VPN, disable unused accounts, require unique strong credentials, and remove access for former staff or suppliers. There is no CISA KEV due date because this CVE is not listed in KEV. Monitor for failed or unexpected successful administrator logins, configuration changes, console-process failures, and unexplained router restarts.

Technical context

CVE-2020-20212 has CVSS v3.1 6.5 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. It is a CWE-476 NULL-pointer dereference/memory-corruption issue in /nova/bin/console that permits authenticated remote denial of service. One public exploit is known. EPSS is 2.3% (83rd percentile) with a flat trend. The CVE is not in CISA KEV; there is no finding confirming exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS84th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

2.3% chance of exploitation activity in the next 30 days, which ranks it in the 84th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-16Patch availablerecord updated
2026-06-25OpenVAS check added
2026-03-06Public exploit / PoCsource: other
2024-11-21Patch availablerecord updated
2021-07-07Publishedweakness classified, att&ck mapped

Affected products

mikrotikcommercial · LVaka routeros, winbox
- routerosNetwork DeviceOn-premNetworking Infrastructure / router-switch

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable