CVE-2017-6297: Medium severity Mikrotik RouterOS vulnerability

Published Feb 27, 2017

Updated

The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.

Other sources

The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.

Affected Software

2 affected components

Mikrotik RouterOS=6.37.4

Mikrotik RouterOS=6.83.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MikroTik RouterOS L2TP Client to a version that resolves this vulnerability.
Fixed in 6.38.3
Upgrade
Upgrade MikroTik RouterOS L2TP Client to a version that resolves this vulnerability.
Fixed in 6.37.4
Upgrade
Upgrade MikroTik RouterOS L2TP Client to a version that resolves this vulnerability.
Fixed in 6.83.3
Compensating control
Until the MikroTik RouterOS L2TP/IPsec encryption issue is resolved, limit exposure by restricting network access to the L2TP server and any management interfaces (e.g., only allow connections from trusted source IPs using firewall/ACL rules).

Event History

Feb 27, 2017

CVE Published

via MITRE·07:25 AM

Data Sourced

via MITRE·07:25 AM

Description

Data Sourced

via NVD·07:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-6297?

CVE-2017-6297 is considered a high severity vulnerability due to the risk of man-in-the-middle attacks.

How do I fix CVE-2017-6297?

Fix CVE-2017-6297 by updating MikroTik RouterOS to the latest version where IPsec encryption is enabled by default after reboot.

Which MikroTik RouterOS versions are affected by CVE-2017-6297?

CVE-2017-6297 affects MikroTik RouterOS versions 6.37.4 and 6.83.3.

What are the risks associated with CVE-2017-6297?

The main risks are exposure of transmitted data unencrypted and unauthorized access to networks due to lack of IPsec encryption.

Is CVE-2017-6297 exploit related to configuration settings?

Yes, CVE-2017-6297 is exploit related to improper configuration of L2TP Client encryption settings after a reboot.