PT-2017-17636 · Mikrotik · Mikrotik+1

Farazpajohan · Published 2017-03-29 · Updated 2017-04-10 · CVE-2017-7285

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MikroTik version 6.38.5

Description A vulnerability in the network stack could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets, preventing the affected router from accepting new TCP connections.

Recommendations For MikroTik version 6.38.5, consider implementing rate limiting on TCP RST packets to mitigate the risk of CPU exhaustion until a patch is available.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2017-7285

Affected Products

Mikrotik

Mikrotik Routeros

References · 5

• 🔥 https://exploit-db.com/exploits/41752 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2017030242 · Exploit
• https://osv.dev/vulnerability/CVE-2017-7285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7285 · Security Note
• http://securityfocus.com/bid/97266 · Note