PT-2017-16976 · Mikrotik · Routeros+1

Ryan Milne · Publicado 2017-02-27 · Atualizado 2019-10-03 · CVE-2017-6297

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions 6.37.4 through 6.83.3

Description The issue concerns the L2TP Client in MikroTik RouterOS, which fails to enable IPsec encryption after a reboot. This allows man-in-the-middle attackers to intercept and view transmitted data without encryption, potentially gaining access to networks on the L2TP server by monitoring packets for transmitted data and obtaining the L2TP secret.

Recommendations For MikroTik RouterOS versions 6.37.4 through 6.83.3, consider temporarily disabling the L2TP Client until a patch is available to ensure IPsec encryption is consistently enabled. Restrict access to sensitive networks and data to minimize the risk of exploitation.

Exploit

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2017-6297

Produtos afetados

Mikrotik Routeros

Routeros

Referências · 4

• 🔥 https://blog.milne.it/2017/02/24/mikrotik-routeros-security-vulnerability-l2tp-tunnel-unencrypted-cve-2017-6297 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6297 · Nota de Segurança
• http://securityfocus.com/bid/96447 · Nota
• https://osv.dev/vulnerability/CVE-2017-6297 · Aviso do Fabricante