CVE-2017-6297CWE-311

CVE-2017-6297

Medium · published February 27, 2017

CVSS v3.0
5.9
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00743 · 54.2th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2017-02-27T12:59Z
Affected products (2)
ProductVersionsFixed in
mikrotik/routerosall versions—
mikrotik/routerosall versions—
References (4)
http://www.securityfocus.com/bid/96447 · [email protected]https://blog.milne.it/2017/02/24/mikrotik-routeros-security-vulnerability-l2tp-tunnel-unencrypted-cve-2017-6297/ · [email protected]http://www.securityfocus.com/bid/96447 · af854a3a-2127-422b-91ae-364da2661108https://blog.milne.it/2017/02/24/mikrotik-routeros-security-vulnerability-l2tp-tunnel-unencrypted-cve-2017-6297/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 27 FEB 07:25Z
    The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to…
    cvelistv5