EUVD-2025-28736
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network. An attacker can leverage this vulnerability to gain access to internal network resources. Was ZDI-CAN-26415.
Analysis
CVE-2025-6443 is an unauthenticated remote access control bypass vulnerability in Mikrotik RouterOS affecting VXLAN traffic handling. The vulnerability allows remote attackers to bypass ingress filtering and gain unauthorized access to internal network resources by exploiting improper validation of remote IP addresses in VXLAN packets. With a CVSS score of 7.2 (Network-based, Low complexity, No privileges required) and unauthenticated exploitation capability, this vulnerability presents a significant risk to exposed RouterOS deployments, particularly those utilizing VXLAN for network segmentation.
Technical Context
VXLAN (Virtual Extensible LAN) is a network virtualization overlay technology that encapsulates Layer 2 frames in UDP packets for transmission across Layer 3 networks. Mikrotik RouterOS implements VXLAN functionality to enable virtual network extension. The vulnerability exists in the ingress traffic processing logic where the RouterOS VXLAN implementation fails to properly validate the source IP address of incoming VXLAN-encapsulated packets against configured remote endpoint restrictions. This is classified as CWE-284 (Improper Access Control - Permissions, Privileges, and Other Access Controls), indicating a fundamental failure in the authorization/authentication mechanism that should restrict which external peers can inject traffic into the VXLAN tunnel. The flaw bypasses network segmentation assumptions that typically rely on tunnel endpoint validation, allowing an unauthenticated remote attacker on the network path to spoof legitimate VXLAN endpoints and inject arbitrary traffic into the internal network that the tunnel protects.
Affected Products
Mikrotik RouterOS - all versions implementing VXLAN functionality appear affected based on the vulnerability description's reference to 'affected installations.' Specific version numbers are not provided in the source data. Organizations should consult Mikrotik's official security advisory for precise version ranges. The vulnerability likely affects RouterOS versions from approximately 6.x forward where VXLAN support was introduced, though confirmation of minimum/maximum affected versions requires vendor documentation. The vulnerability is specific to RouterOS deployments where VXLAN is configured and exposed to network paths potentially containing untrusted traffic sources. CPE data (if available from NVD) would typically enumerate: cpe:2.3:o:mikrotik:routeros:*:* (with version constraints to be determined from vendor advisory).
Remediation
Mitigation steps should include: (1) Immediate: Implement network-level filtering to restrict which IP addresses can send VXLAN packets (UDP port 4789 encapsulation) to RouterOS devices; restrict VXLAN tunnel endpoints to a whitelist of known legitimate peers at the network perimeter, (2) Patch: Apply the latest Mikrotik RouterOS security update addressing CVE-2025-6443 - consult Mikrotik's official security announcements at https://mikrotik.com/download/security for patched versions, (3) Workaround (if patching delayed): Disable VXLAN functionality if not actively required, or isolate VXLAN-enabled RouterOS devices on segregated management networks with strict egress filtering, (4) Detection: Monitor for VXLAN packets (UDP 4789) from unexpected source IPs; alert on anomalous VXLAN endpoint changes in RouterOS configurations, (5) Validation: After patching, verify that VXLAN remote IP validation is now properly enforced through RouterOS CLI commands reviewing VXLAN interface peer configurations. Vendor patch timeline and specific patched version numbers should be obtained directly from Mikrotik security advisories.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today