Servers and applications
CVE-2017-6297
The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.
- Severity
- Medium 5.9
- Published
- 27 Feb 2017
- Last changed
- 16 Sept 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 0.7% in the next 30 daysHigher than 55% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Missing encryption (CWE-311)
- Attack
- Over the network · Only under certain conditions · No login needed · No user action needed
- Attacker can
- Read data
- CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MikroTik RouterOSServers and applications · cpe:o:mikrotik:routeros |
|