Hello!!
Is this fixed in one of the realeses??
thank you!
M
But are you posting links randomly?
It's already written in the link.
Fixed in RouterOS v7.20
@MikroTik:
Why is it not mentioned here: https://mikrotik.com/supportsec ?!
But... Ask MikroTik, we are only users... support@mikrotik.com
Often, details aren't released until a patch is already available and distributed...
7.19.5 / 7.19.6 was released just today.
I want to clarify a few things.
The vulnerability description is somewhat misleading. It states that you can “bypass access restrictions” and that there is a “lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network.”
In reality, this vulnerability is related to VXLAN data-plane learning. VXLAN learning is described in RFC 7348 and works similarly to how Ethernet switches learn MAC addresses. For example, if you inject a source MAC address on a switch port, the switch will associate that MAC with the new port and forward traffic there, effectively “hijacking” the traffic.
With VXLAN, the same principle applies. By injecting a VXLAN-encapsulated packet with a chosen source IP, the system will learn the outer source IP together with the inner source MAC. This can redirect traffic destined for the inner source MAC to the attacker’s chosen IP.
The confusion comes from the assumption that the "remote-ip" setting under /interface/vxlan/vtep is intended as an access control mechanism. It is not. That option is used to configure remote IPs for handling BUM (broadcast, unknown unicast, and multicast) traffic that must be sent through VXLAN. It has nothing to do with VXLAN data-plane learning and forwarding. If you need access control, the correct solution is to use the IP firewall.
Starting from RouterOS v7.20, we added a learning=yes/no property. This allows you to disable data-plane learning and instead use control-plane mechanisms such as EVPN for forwarding.
As a side note, creating VXLAN interfaces with Linux ip link behaves the same way as RouterOS - it enables data-plane learning by default.