CVE-2017-8338

High

Published: 18/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A vulnerability in MikroTik Version 6.38.5 allows an unauthenticated remote attacker to exhaust all available CPU by flooding UDP packets on port 500, preventing the affected router from accepting new connections.

Risk Assessment

The attack can lead to all devices being disconnected from the router and logs being automatically removed, impacting network availability and security.

Recommendation

It is recommended to update MikroTik software to the latest version to mitigate this vulnerability and to monitor traffic on port 500.

Other vulnerabilities in MikroTik Version 6.38.5

CVE-2017-7285High
A vulnerability in the network stack of MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets, preventing the affected router from accepting new TCP connections.

Original NVD description (English source)

A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 (used for L2TP over IPsec), preventing the affected router from accepting new connections; all devices will be disconnected from the router and all logs removed automatically.