What is the CVSS score of CVE-2025-6443?

CVE-2025-6443 has a CVSS 3.0 base score of 7.2 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Routeros are affected by CVE-2025-6443?

This vulnerability affects Mikrotik RouterOS devices and allows unauthenticated remote attackers to bypass network access controls and reach internal resources by exploiting improper validation of…

How to fix or mitigate CVE-2025-6443?

Within 24 hours: Identify all Mikrotik RouterOS devices in your network using VXLAN and assess their exposure to untrusted networks; immediately restrict network access to affected devices where possible. Within 7 days: Implement network segmentation to isolate VXLAN traffic and disable VXLAN functionality if not essential to operations; monitor for suspicious access attempts. Within 30 days: Contact Mikrotik for patch availability updates; prepare upgrade procedures and test in non-production environments; deploy patches immediately upon release.

Routeros CVE-2025-6443

EUVD-2025-28736 HIGH

Improper Access Control (CWE-284)

2025-06-25 zdi-disclosures@trendmicro.com

Mikrotik Authentication Bypass Routeros

7.2

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-28736

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 22:15 nvd

HIGH 7.2

DescriptionCVE.org

Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network. An attacker can leverage this vulnerability to gain access to internal network resources. Was ZDI-CAN-26415.

AnalysisAI

CVE-2025-6443 is an unauthenticated remote access control bypass vulnerability in Mikrotik RouterOS affecting VXLAN traffic handling. The vulnerability allows remote attackers to bypass ingress filtering and gain unauthorized access to internal network resources by exploiting improper validation of remote IP addresses in VXLAN packets. With a CVSS score of 7.2 (Network-based, Low complexity, No privileges required) and unauthenticated exploitation capability, this vulnerability presents a significant risk to exposed RouterOS deployments, particularly those utilizing VXLAN for network segmentation.

Technical ContextAI

VXLAN (Virtual Extensible LAN) is a network virtualization overlay technology that encapsulates Layer 2 frames in UDP packets for transmission across Layer 3 networks. Mikrotik RouterOS implements VXLAN functionality to enable virtual network extension. The vulnerability exists in the ingress traffic processing logic where the RouterOS VXLAN implementation fails to properly validate the source IP address of incoming VXLAN-encapsulated packets against configured remote endpoint restrictions. This is classified as CWE-284 (Improper Access Control - Permissions, Privileges, and Other Access Controls), indicating a fundamental failure in the authorization/authentication mechanism that should restrict which external peers can inject traffic into the VXLAN tunnel. The flaw bypasses network segmentation assumptions that typically rely on tunnel endpoint validation, allowing an unauthenticated remote attacker on the network path to spoof legitimate VXLAN endpoints and inject arbitrary traffic into the internal network that the tunnel protects.

RemediationAI

Mitigation steps should include: (1) Immediate: Implement network-level filtering to restrict which IP addresses can send VXLAN packets (UDP port 4789 encapsulation) to RouterOS devices; restrict VXLAN tunnel endpoints to a whitelist of known legitimate peers at the network perimeter, (2) Patch: Apply the latest Mikrotik RouterOS security update addressing CVE-2025-6443 - consult Mikrotik's official security announcements at https://mikrotik.com/download/security for patched versions, (3) Workaround (if patching delayed): Disable VXLAN functionality if not actively required, or isolate VXLAN-enabled RouterOS devices on segregated management networks with strict egress filtering, (4) Detection: Monitor for VXLAN packets (UDP 4789) from unexpected source IPs; alert on anomalous VXLAN endpoint changes in RouterOS configurations, (5) Validation: After patching, verify that VXLAN remote IP validation is now properly enforced through RouterOS CLI commands reviewing VXLAN interface peer configurations. Vendor patch timeline and specific patched version numbers should be obtained directly from Mikrotik security advisories.