CVE-2023-32154

Executive Summary

CVE-2023-32154 is a critical remote code execution vulnerability in MikroTik RouterOS, specifically within the Router Advertisement Daemon (RADVD). The flaw is an out-of-bounds write caused by insufficient validation of user-supplied data, allowing a network-adjacent attacker to execute arbitrary code with root privileges without authentication. The vulnerability has a CVSS score of 7.5 (High) and affects all RouterOS versions where RADVD is enabled. No public proof-of-concept or patch details are currently available, but the risk is significant due to the widespread deployment of MikroTik devices in enterprise and ISP environments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – The attacker must be on the same Layer 2 network segment.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The exploit does not cross trust boundaries.
• Confidentiality (C): High (C:H) – Full system compromise possible.
• Integrity (I): High (I:H) – Attacker can modify system files.
• Availability (A): High (A:H) – Potential for denial of service or full control.

Threat Level: High – Exploitation is likely once a PoC is released, and the attack surface is large due to RADVD being enabled by default in many configurations.

Deep Dive & Mechanics

The vulnerability resides in the Router Advertisement Daemon (RADVD), which processes IPv6 Router Advertisement (RA) messages. The flaw is an out-of-bounds write (CWE-787) in the handling of crafted RA packets. Specifically, when parsing certain options within an RA message, the code fails to validate the length of the data before copying it into a fixed-size buffer. This allows an attacker to write past the end of the buffer, corrupting adjacent memory.

Attack Flow:

1. The attacker sends a malicious IPv6 Router Advertisement packet to the target device.
2. The RADVD process receives the packet and begins parsing its options.
3. Due to missing length checks, the parser copies attacker-controlled data beyond the allocated buffer.
4. This overwrites critical data structures, such as function pointers or return addresses.
5. The attacker can then redirect execution flow to shellcode, achieving remote code execution as root.

The vulnerability is particularly dangerous because RADVD runs with root privileges, and no authentication is required. The attack is limited to network-adjacent attackers (same broadcast domain), but this still exposes internal networks and DMZ segments.

Vulnerable vs. Patched Code

Since no official patch or source code diff is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (C-like pseudocode):

void process_ra_option(uint8_t *option, uint16_t len) {
    uint8_t buffer[64];
    // Missing length check
    memcpy(buffer, option, len); // Out-of-bounds write if len > 64
}

Patched Code (C-like pseudocode):

void process_ra_option(uint8_t *option, uint16_t len) {
    uint8_t buffer[64];
    if (len > sizeof(buffer)) {
        // Log error and drop packet
        return;
    }
    memcpy(buffer, option, len);
}

The fix adds a bounds check before the memcpy operation, ensuring that the data length does not exceed the buffer size.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Target: MikroTik RouterOS (any version with RADVD enabled, e.g., 7.6)
• Attacker: Kali Linux with scapy or custom Python script
• Network: Same Layer 2 segment (e.g., Ethernet or Wi-Fi)

Exploitation Steps:

1. Identify a vulnerable MikroTik device using Shodan or local scanning.
2. Craft a malicious IPv6 Router Advertisement packet with an oversized option field.
3. Send the packet to the target's link-local address.
4. The RADVD process crashes or executes shellcode, granting a root shell.

Example Python script (conceptual):

from scapy.all import *
import struct

# Craft malicious RA packet
ra = IPv6(dst="ff02::1") / ICMPv6ND_RA() / ICMPv6NDOptPrefixInfo()
# Add oversized option to trigger overflow
ra /= Raw(load=b"A"*200)  # Overflow buffer

send(ra, iface="eth0")

Note: No public exploit code is available; this is a conceptual example.

Blue Team (Defense)

Detection & Prevention:

• Disable RADVD if IPv6 is not required: /ipv6 nd set [find] disabled=yes
• Monitor for excessive or malformed RA packets using network monitoring tools.
• Implement RA Guard (RFC 6105) on switches to block unauthorized RA messages.
• Use intrusion detection systems (e.g., Suricata) with custom rules to detect RA-based attacks.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual IPv6 Router Advertisement packets with oversized options (e.g., length > 64 bytes).
  • Multiple RA packets from a single source within a short time window.
  • RA packets with non-standard option types or malformed headers.

• Host IOCs:

  • Unexpected crashes or restarts of the RADVD process.
  • Presence of unknown processes or files in /tmp/ or /flash/.
  • Modified system binaries or configuration files.

• Log IOCs:

  • RouterOS logs showing RADVD errors or crashes: /log print where topics~"radvd"
  • System logs indicating memory corruption or segmentation faults.

Detection Engineering

YARA Rule

rule CVE_2023_32154_RADVD_Exploit {
    meta:
        description = "Detects malicious IPv6 Router Advertisement packets targeting CVE-2023-32154"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-32154"
    strings:
        $ra_header = { 86 00 }  // ICMPv6 RA type and code
        $overflow = /.{200,}/   // Packet payload > 200 bytes
    condition:
        $ra_header at 0 and #overflow > 0
}

Sigma Rule

title: CVE-2023-32154 RADVD Out-of-Bounds Write
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2023-32154 via malformed IPv6 RA packets
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 3000001
    condition: selection
falsepositives:
    - Legitimate RA packets with large options (rare)
level: high

Suricata Rule

alert ipv6 any any -> any any (msg:"CVE-2023-32154 RADVD Out-of-Bounds Write Attempt"; ip_proto:58; icmp_type:134; content:"|86 00|"; depth:2; byte_test:1,>,64,4; sid:3000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable RADVD if IPv6 is not required: /ipv6 nd set [find] disabled=yes
2. Apply access control lists (ACLs) to restrict RA packets to trusted sources only.
3. Enable RA Guard on managed switches to filter unauthorized RA messages.

Long-Term Fixes:

• Monitor MikroTik's official channels for a firmware patch.
• Upgrade to a patched version once released.
• Implement network segmentation to limit exposure of critical devices.

Workarounds:

• Use firewall rules to drop ICMPv6 type 134 (Router Advertisement) from untrusted sources.
• Disable IPv6 entirely if not needed: /ipv6 settings set disable-ipv6=yes

Valters IT
DevSecOps & Cyber Threat Intelligence