9.1Crítica KEV

CVE-2018-14847MikroTik Router OS Directory Traversal Vulnerability

mikrotik routeros Publicada: 2018-08-02 10:00 (hace 8 años)

Explotación conocida — MikroTik Router OS Directory Traversal Vulnerability

CISA confirmó el 01.12.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 01.06.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-14847

Descripción

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Debilidad (CWE): CWE-22

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
mikrotik	routeros	≤ 6.42

Referencias y parches

45578 exploitExploitThird Party AdvisoryVDB Entry
https://github.com/BigNerd95/WinboxExploit ExploitMitigationThird Party Advisory
https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf Broken LinkExploitThird Party Advisory
https://github.com/BasuCert/WinboxPoC ExploitMitigationThird Party Advisory
https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847 ExploitThird Party Advisory
https://n0p.me/winbox-bug-dissection/ ExploitThird Party Advisory
https://github.com/tenable/routeros/tree/master/poc/bytheway ExploitThird Party Advisory
https://mikrotik.com/supportsec/winbox-vulnerability Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847 US Government Resource

Coincidencias CPE (NVD) (1)

cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* ≤ 6.42

Puntuación CVSS

9.1Crítica

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Ninguno

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Todas las puntuaciones (4)

CISA-ADP	CVSS 3.1	9.1Crítica
nvd	CVSS 3.1	9.1Crítica
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.1Crítica
nvd	CVSS 2.0	6.4Media

EPSS (probabilidad de explotación en 30 días)

95.98%

superior al 100 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: active
Automatizable: yes
Impacto técnico: total

Cronología

ID reservado2018-08-02
Publicada2018-08-02 10:00
Llegó a IP-DB2026-10-24 23:34
Añadida a KEV2021-12-01
Última actualización2026-06-17 04:41

Asignada por (CNA): mitre
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — MikroTik RouterOS

7.4Alta

CVE-2026-89035 hace 13 días

MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass

MikroTik RouterOS

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so g…

6.5Media

CVE-2026-112158 hace 15 días

MikroTik RouterOS ipt_SAME.ko same_check integer overflow

MikroTik RouterOS

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 …

8.8Alta

CVE-2026-103903 hace 22 días

MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation

MikroTik RouterOS

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different exist…

9.8Crítica

CVE-2026-84411 hace 1 mes

MikroTik RouterOS Integer Underflow

MikroTik RouterOS

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution …

7.5Alta

CVE-2026-93345 hace 1 mes

MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI

MikroTik RouterOS

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDA…

7.5Alta

CVE-2026-89028 hace 1 mes

MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX

MikroTik RouterOS

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can…