CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 2CVE-2017-7285 – MikroTik RouterBoard 6.38.5 - Denial of Service
https://notcve.org/view.php?id=CVE-2017-7285
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets, preventing the affected router from accepting new TCP connections. Vulnerabilidad en la pila de la red de MikroTik Version 6.38.5 liberada 09-03-2017 podría permitir a un atacante remoto no autenticado agotar toda la CPU disponible a través de una inundación de paquetes TCP RST, evitando que el enrutador afectado acepte nuevas conexiones TCP. Mikrotik RouterBoard version 6.38.5 suffers from a denial of service vulnerability. • https://www.exploit-db.com/exploits/41752 http://www.securityfocus.com/bid/97266 https://cxsecurity.com/issue/WLB-2017030242 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2017-6297
https://notcve.org/view.php?id=CVE-2017-6297
The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret. El Cliente L2TP en MikroTik RouterOS versiones 6.83.3 y 6.37.4 no habilita el cifrado IPsec después de un reinicio, lo que permite a atacantes man-in-the-middle ver los datos transmitidos sin cifrar y obtener acceso a las redes en el servidor L2TP monitorizando los paquetes para los datos transmitidos y obtener el secreto L2TP. • http://www.securityfocus.com/bid/96447 https://blog.milne.it/2017/02/24/mikrotik-routeros-security-vulnerability-l2tp-tunnel-unencrypted-cve-2017-6297 • CWE-311: Missing Encryption of Sensitive Data •