{"id":"CVE-2017-6297","title":"The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server…","summary":"The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-311"],"vendor":"mikrotik","product":"routeros","affected":["routeros = 6.37.4","routeros = 6.83.3"],"published":"2017-02-27","updated":"2026-09-16","sourceUpdated":"2026-09-16T21:17:05.393","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2017-6297","references":[{"url":"http://www.securityfocus.com/bid/96447","label":"cve@mitre.org"},{"url":"https://blog.milne.it/2017/02/24/mikrotik-routeros-security-vulnerability-l2tp-tunnel-unencrypted-cve-2017-6297/","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/96447","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blog.milne.it/2017/02/24/mikrotik-routeros-security-vulnerability-l2tp-tunnel-unencrypted-cve-2017-6297/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00758,"epssPercentile":0.53262,"ingestedAt":"2026-09-16T21:05:36.878Z","slug":"CVE-2017-6297","body":"## Overview\n\nThe L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.\n\n## Affected\n\n- `routeros = 6.37.4`\n- `routeros = 6.83.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":205789,"id":"CVE-2017-6297","ts":1789596445169,"field":"cvss","old":null,"new":"5.9"},{"seq":205788,"id":"CVE-2017-6297","ts":1789596445169,"field":"severity","old":"none","new":"medium"}]}