important · Wi-Fi — RouterOS
A RouterOS read-only operator can control native execution in the x86 mtget helper.
Affects
MikroTik RouterOS, the operating system used by MikroTik routers and CHR virtual routers; exploit control was demonstrated on x86 CHR.
A test-policy account invokes /tool fetch with an overlong TFTP pathname, overwriting saved EIP and the post-return stack.
Detail and 2 sources
The public ROP proof demonstrates a controlled unlink call through a fixed PLT address.