CVE-2023-47310
📋 TL;DR
A default configuration vulnerability in MikroTik RouterOS 7 allows incoming IPv6 UDP traceroute packets to bypass firewall rules. This affects all MikroTik RouterOS 7 installations with default settings, potentially exposing internal networks to unauthorized access.
💻 Affected Systems
- MikroTik RouterOS
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass firewall protections entirely, gaining unauthorized access to internal network resources and potentially launching further attacks.
Likely Case
Network reconnaissance and information leakage about internal network topology and services through IPv6 traceroute responses.
If Mitigated
Minimal impact if proper firewall rules are configured to block unauthorized IPv6 traffic.
🎯 Exploit Status
Exploitation requires sending specially crafted IPv6 UDP traceroute packets to vulnerable devices.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RouterOS 7.14
Vendor Advisory: https://forum.mikrotik.com/t/fixed-in-7-14-security-vulnerability-default-configuration-firewall-bypass-for-ipv6-udp/262186
Restart Required: Yes
Instructions:
1. Log into RouterOS web interface or CLI. 2. Check current version with '/system package update check'. 3. If version is below 7.14, download and install RouterOS 7.14 update. 4. Reboot the router after installation completes.
🔧 Temporary Workarounds
Manual IPv6 Firewall Rule
allAdd explicit firewall rule to block incoming IPv6 UDP traceroute packets
/ipv6 firewall filter add chain=input protocol=udp dst-port=33434-33523 action=drop comment="Block IPv6 traceroute"
🧯 If You Can't Patch
- Disable IPv6 entirely if not required for network operations
- Implement network-level filtering to block IPv6 UDP traceroute packets at upstream devices
🔍 How to Verify
Check if Vulnerable:
Check RouterOS version with '/system resource print' - if version is below 7.14 and IPv6 is enabled, system is vulnerable.Check Version:
/system resource printVerify Fix Applied:
After updating to 7.14, verify version with '/system resource print' and test with IPv6 traceroute packets from external network.📡 Detection & Monitoring
Log Indicators:
- Unexpected IPv6 UDP packets on ports 33434-33523 in firewall logs
- Increased IPv6 traffic from external sources
Network Indicators:
- IPv6 traceroute responses from internal network to external sources
- Unusual IPv6 UDP traffic patterns
SIEM Query:
source_port IN (33434-33523) AND protocol=udp AND ip_version=6