Routeros EUVD-2025-28736

This vulnerability represents HIGH real-world risk based on multiple converging signals: (1) CVSS 7.2 with AV:N/AC:L/PR:N indicates network-accessible exploitation with no prerequisites, (2) Complete lack of authentication requirement dramatically lowers the practical barrier to exploitation, (3) CWE-284 access control flaws are consistently among the most exploited vulnerability classes, (4) The scope change (C:L/I:L) indicates cross-boundary impact affecting confidentiality and integrity of internal resources, (5) VXLAN is increasingly deployed in modern network architectures for cloud and data center isolation, making potential blast radius significant. The vulnerability was tracked as ZDI-CAN-26415 through Trend Micro's Zero Day Initiative, suggesting coordinated disclosure practices. Without explicit KEV/CISA, EPSS, or POC confirmation in provided data, the assessment leans toward high priority due to the fundamental nature of the flaw (unauthenticated access control bypass on a tunneling protocol) and the likely timing of active exploitation post-disclosure given the accessibility and value of internal network access.

An attacker positioned on the network path between legitimate VXLAN endpoints (or anywhere with network access to a RouterOS device running vulnerable VXLAN) crafts and sends UDP packets on port 4789 with VXLAN headers and source IP spoofed to match a configured legitimate remote tunnel endpoint. Due to improper validation in RouterOS, the device accepts these packets without verifying the actual source IP against the configured whitelist, allowing the attacker's crafted packets to be unwrapped and their payload injected into the internal VXLAN network segment. The attacker gains layer 2 access to internal network segments that should only be reachable through authenticated tunnel endpoints. This could enable lateral movement to reach internal servers, steal sensitive data traversing the VXLAN segment, perform man-in-the-middle attacks on internal communications, or establish persistent access. No special tools beyond standard packet crafting (scapy, etc.) are required. The attack is not automatable at scale without knowledge of the target's network topology, but individual targeted exploitation requires minimal complexity given the unauthenticated nature and low barrier to crafting VXLAN packets.