IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
9.8Critical KEV

CVE-2018-7445MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability

mikrotik routeros Published: (8 years ago)

Known exploited — MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability

CISA confirmed this vulnerability is used in real attacks on 08.09.2022. Remediation deadline for US federal agencies: 29.09.2022.

Required action: Apply updates per vendor instructions. https://www.coresecurity.com/core-labs/advisories/mikrotik-routeros-smb-buffer-overflow#vendor_update, https://mikrotik.com/download; https://nvd.nist.gov/vuln/detail/CVE-2018-7445

Description

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.

Weakness (CWE): CWE-119

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
mikrotik routeros < 6.41.3

References and patches

CPE matches (NVD) (13)
  • cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* < 6.41.3
  • cpe:2.3:o:mikrotik:routeros:6.42:rc11:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc12:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc14:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc15:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc18:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc2:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc20:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc23:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc24:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc5:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc6:*:*:*:*:*:*
  • cpe:2.3:o:mikrotik:routeros:6.42:rc9:*:*:*:*:*:*

Recent CVEs in the same product — MikroTik RouterOS

6.5Medium
CVE-2026-112158

MikroTik RouterOS ipt_SAME.ko same_check integer overflow

MikroTik RouterOS

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 …

9.8Critical
CVE-2026-84411

MikroTik RouterOS Integer Underflow

MikroTik RouterOS

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution …