[fixed in 7.14] Security vulnerability: Default configuration firewall bypass for IPv6 UDP

RouterOS
1

I identified a security vulnerability in the RouterOS default IPv6 firewall rule some time ago:

/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp

An attacker is in control of the source port, thereby can craft IPv6 packets in this range to always be accepted by the default firewall rules, exposing all UDP services including CAPsMAN, DNS, container and otherwise where enabled.

I logged this into CVE-2023-47310 for publication some time after MikroTik released the fix. Working with MikroTik, the default firewall rules were updated in RouterOS 7.14 to fix this.

Please check your scripts and correct to: dst-port=33434-33534.

Thanks,
Dan

1 Like
2

This CVE number you named is still only reserved and not published. https://www.cve.org/CVERecord?id=CVE-2023-47310