High SEVERITY — Vulnerability

CVE-2025-6443 — Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability.

Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress t

Platform
MikroTik RouterOS
CVE Record
CVE-2025-6443
CVSS Score
7.2/10
Published
25 June 2025
Views
3
Primary source: Review the official advisory at nvd.nist.gov Kaynağa Git

Özet

Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network. An attacker can leverage this vulnerability to gain access to internal network resources. Was ZDI-CAN-26415.

Değerlendirme

  • CVE: CVE-2025-6443
  • CVSS taban puanı: 7.2
  • Vektör: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  • Kaynak: NVD kaydı

Referanslar

Aksiyon

  • Etkilenen sistemleri envanterden doğrulayın
  • Üretici yamasını bakım penceresinde uygulayın
  • Yama uygulanana kadar erişimi ağ katmanında kısıtlayın
routeros *

MikroTik RouterOS — Related Advisories

VIEW ALL →
MikroTik RouterOS 11 Feb 2025
Medium · 5.4

CVE-2024-54772 — An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stabl

An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.

CVE-2024-54772 Vulnerability 1
MikroTik RouterOS 03 May 2024
High · 7.5

CVE-2023-32154 — Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability.

Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An

CVE-2023-32154 Vulnerability 3