CVE-2023-47310

Executive Summary

CVE-2023-47310 is a misconfiguration in the default settings of MikroTik RouterOS version 7, fixed in v7.14, that allows incoming IPv6 UDP traceroute packets. This vulnerability enables an unauthenticated, remote attacker to perform network reconnaissance by sending crafted IPv6 UDP packets to the device, potentially revealing internal network topology and device information. The issue stems from a default firewall rule that permits incoming IPv6 UDP traceroute traffic, which should be blocked by default. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is low (CVSS 5.3) as it primarily exposes information without direct system compromise.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the MikroTik RouterOS firmware, which is distributed directly by MikroTik. Users should verify firmware integrity via official channels and checksums.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Information disclosure of network topology
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: Low – Exploitation is trivial but only yields reconnaissance data.

Deep Dive & Mechanics

The vulnerability exists in the default firewall configuration of MikroTik RouterOS 7.x. By default, the router accepts incoming IPv6 UDP packets with a hop limit of 1 (traceroute packets). This allows an attacker to send a crafted IPv6 UDP packet to the router's WAN interface and receive an ICMPv6 Time Exceeded response, revealing the router's presence and potentially internal network hops.

Root Cause: The default firewall rule input chain does not drop IPv6 UDP traceroute packets. In RouterOS 7, the default configuration includes a rule that accepts such packets, which should be blocked to prevent network mapping.

Attack Flow:

1. Attacker sends an IPv6 UDP packet with a hop limit of 1 to the target router's WAN IP.
2. The router processes the packet and responds with an ICMPv6 Time Exceeded message.
3. The attacker can repeat this with varying hop limits to map the network path.

Vulnerable vs. Patched Code

Vulnerable Configuration (RouterOS < 7.14):

/ipv6 firewall filter
add chain=input protocol=udp dst-port=33434-33534 action=accept

Patched Configuration (RouterOS >= 7.14):

/ipv6 firewall filter
add chain=input protocol=udp dst-port=33434-33534 action=drop

The fix involves changing the default rule from accept to drop for UDP traceroute ports.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: MikroTik RouterOS 7.13 (vulnerable)
• Attacker: Linux machine with IPv6 connectivity

Exploitation Steps:

1. Identify the target's IPv6 address (e.g., via Shodan or scanning).
2. Send a traceroute using IPv6 UDP:

   traceroute6 -p 33434 <target_ipv6>
   

3. Alternatively, use a custom Python script:

   import socket
   import sys
   
   def send_traceroute(target_ip, port=33434):
       sock = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
       sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_UNICAST_HOPS, 1)
       sock.sendto(b'', (target_ip, port))
       sock.close()
   
   if __name__ == "__main__":
       send_traceroute(sys.argv[1])
   

Expected Output: ICMPv6 Time Exceeded response from the router.

Blue Team

Detection:

• Monitor for incoming IPv6 UDP packets to ports 33434-33534 with hop limit 1.
• Alert on ICMPv6 Time Exceeded messages originating from the router.

Mitigation:

• Apply the patch (upgrade to v7.14).
• Manually add a firewall rule to drop such packets:

  /ipv6 firewall filter add chain=input protocol=udp dst-port=33434-33534 action=drop
  

Indicators of Compromise (IOCs)

• Network Traffic:
  • Incoming IPv6 UDP packets to ports 33434-33534 with hop limit 1.
  • Outgoing ICMPv6 Time Exceeded messages from the router.
• Logs:
  • RouterOS logs showing input chain matches for UDP port 33434-33534.
• Shodan Dorks:
  • MikroTik RouterOS 7
  • MikroTik RouterOS 7.13

Detection Engineering

YARA Rule

rule CVE_2023_47310_MikroTik_Traceroute {
    meta:
        description = "Detects IPv6 UDP traceroute packets targeting MikroTik RouterOS"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2023-47310"
    strings:
        $udp_traceroute = { 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 }
    condition:
        // Check for UDP destination port in traceroute range (33434-33534)
        uint16(0) >= 33434 and uint16(0) <= 33534 and
        // Check for IPv6 header (next header = UDP)
        // This is a simplified example; real implementation would parse IP headers
        $udp_traceroute
}

Sigma Rule

title: Detection of IPv6 UDP Traceroute to MikroTik RouterOS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects incoming IPv6 UDP packets to ports 33434-33534 with hop limit 1
author: Valters IT
date: 2025-04-01
logsource:
    category: network_connection
    product: mikrotik
detection:
    selection:
        protocol: udp
        dst_port:
            - 33434
            - 33534
        ip_version: 6
        hop_limit: 1
    condition: selection
falsepositives:
    - Legitimate traceroute tools
level: medium

Suricata Rule

alert udp any any -> any 33434:33534 (msg:"CVE-2023-47310 - IPv6 UDP Traceroute to MikroTik RouterOS"; ip_proto:udp; ipv6; threshold:type both, track by_src, count 1, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to MikroTik RouterOS v7.14 or later.
2. Workaround: Add a firewall rule to drop incoming IPv6 UDP packets to ports 33434-33534:

   /ipv6 firewall filter add chain=input protocol=udp dst-port=33434-33534 action=drop
   

3. Long-term: Implement strict default-deny firewall policies for IPv6.
4. Monitoring: Enable logging for firewall drops and monitor for traceroute attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence