CVE-2017-6297 | BDVDB-2026-82120 Detail

Description#

The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://blog.milne.it/2017/02/24/mikrotik-routeros-security-vulnerability-l2tp-tunnel-unencrypted-cve-2017-6297/
http://www.securityfocus.com/bid/96447

Exploit#

No public exploit known

History#

Version 12017-02-27Record published in the CVE List.
Version 22026-09-16Most recent update recorded in the CVE List.