PT-2017-18283 · Mikrotik · Mikrotik+1

Farazpajohan + 1 · Publicado 2017-05-18 · Atualizado 2019-10-03 · CVE-2017-8338

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MikroTik version 6.38.5

Description A vulnerability could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500, which is used for L2TP over IPsec. This prevents the affected router from accepting new connections, causing all devices to be disconnected from the router and all logs to be removed automatically.

Recommendations For MikroTik version 6.38.5, consider restricting access to port 500 to minimize the risk of exploitation. As a temporary workaround, limiting the number of incoming UDP packets on this port may help mitigate the issue until a patch is available.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2017-8338

Produtos afetados

Mikrotik

Mikrotik Routeros

Referências · 6

• 🔥 https://cxsecurity.com/issue/WLB-2017050062 · Exploit
• 🔥 https://packetstormsecurity.com/files/142538/MikroTik-RouterBoard-6.38.5-Denial-Of-Service.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/May/59 · Exploit
• 🔥 https://vulnerability-lab.com/get_content.php?id=2064 · Exploit
• https://osv.dev/vulnerability/CVE-2017-8338 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8338 · Nota de Segurança