9.1Critical KEV

CVE-2018-14847MikroTik Router OS Directory Traversal Vulnerability

mikrotik routeros Published: 2018-08-02 10:00 (8 years ago)

Known exploited — MikroTik Router OS Directory Traversal Vulnerability

CISA confirmed this vulnerability is used in real attacks on 01.12.2021. Remediation deadline for US federal agencies: 01.06.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-14847

Description

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Weakness (CWE): CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
mikrotik	routeros	≤ 6.42

References and patches

45578 exploitExploitThird Party AdvisoryVDB Entry
https://github.com/BigNerd95/WinboxExploit ExploitMitigationThird Party Advisory
https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf Broken LinkExploitThird Party Advisory
https://github.com/BasuCert/WinboxPoC ExploitMitigationThird Party Advisory
https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847 ExploitThird Party Advisory
https://n0p.me/winbox-bug-dissection/ ExploitThird Party Advisory
https://github.com/tenable/routeros/tree/master/poc/bytheway ExploitThird Party Advisory
https://mikrotik.com/supportsec/winbox-vulnerability Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847 US Government Resource

CPE matches (NVD) (1)

cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* ≤ 6.42

CVSS score

9.1Critical

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

All scores (4)

CISA-ADP	CVSS 3.1	9.1Critical
nvd	CVSS 3.1	9.1Critical
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.1Critical
nvd	CVSS 2.0	6.4Medium

EPSS (chance of exploitation in 30 days)

95.98%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: yes
Technical impact: total

Timeline

ID reserved2018-08-02
Published2018-08-02 10:00
Reached IP-DB2026-10-24 23:34
Added to KEV2021-12-01
Last updated2026-06-17 04:41

Assigned by (CNA): mitre
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — MikroTik RouterOS

7.4High

CVE-2026-89035 12 days ago

MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass

MikroTik RouterOS

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so g…

6.5Medium

CVE-2026-112158 14 days ago

MikroTik RouterOS ipt_SAME.ko same_check integer overflow

MikroTik RouterOS

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 …

8.8High

CVE-2026-103903 22 days ago

MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation

MikroTik RouterOS

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different exist…

9.8Critical

CVE-2026-84411 1 month ago

MikroTik RouterOS Integer Underflow

MikroTik RouterOS

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution …

7.5High

CVE-2026-93345 1 month ago

MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI

MikroTik RouterOS

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDA…

7.5High

CVE-2026-89028 1 month ago

MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX

MikroTik RouterOS

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can…