CVE-2017-6444

The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many ACK packets. After the attacker stops the exploit, the CPU usage is 100% and the router requires a reboot for normal operation.

• CWE-400

• http://www.exploitalert.com/view-details.html?id=26137Exploit, Third Party Advisory
• https://cxsecurity.com/issue/WLB-2017030029Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/141449/Mikrotik-Hap-Lite-6.25-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/41601/Exploit, Third Party Advisory, VDB Entry
• http://www.exploitalert.com/view-details.html?id=26137Exploit, Third Party Advisory
• https://cxsecurity.com/issue/WLB-2017030029Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/141449/Mikrotik-Hap-Lite-6.25-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/41601/Exploit, Third Party Advisory, VDB Entry

Published

Mar 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6437The base64encode function in base64.c in libimobiledevice li…
• CVE-2017-6438Heap-based buffer overflow in the parse_unicode_node functio…
• CVE-2017-6439Heap-based buffer overflow in the parse_string_node function…
• CVE-2017-6440The parse_data_node function in bplist.c in libimobiledevice…
• CVE-2017-6441The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7…
• CVE-2017-6443Cross-site scripting (XSS) vulnerability in EPSON TMNet WebC…
• CVE-2017-6445The auto-update feature of Open Embedded Linux Entertainment…
• CVE-2017-6446XSS was discovered in Dotclear v2.11.2, affecting admin/blog…
• CVE-2017-6448The dalvik_disassemble function in libr/asm/p/asm_dalvik.c i…
• CVE-2017-6451The mx4200_send function in the legacy MX4200 refclock in NT…
• CVE-2017-6452Stack-based buffer overflow in the Windows installer for NTP…
• CVE-2017-6453Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…