CVE-2018-14847

KEVMikroTik Router OS Directory Traversal Vulnerability

Description

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

PublishedAug 2, 2018

Last modifiedJun 17, 2026

Added to KEVDec 1, 2021

Remediation dueJun 1, 2022

References

github.com/BasuCert/WinboxPoCExploitMitigation
github.com/BigNerd95/WinboxExploitExploitMitigation
github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdfBroken LinkExploit
github.com/tenable/routeros/tree/master/poc/bythewayExploitThird Party Advisory
github.com/tenable/routeros/tree/master/poc/cve_2018_14847ExploitThird Party Advisory
mikrotik.com/supportsec/winbox-vulnerabilityVendor Advisory
n0p.me/winbox-bug-dissection/ExploitThird Party Advisory
exploit-db.com/exploits/45578/ExploitThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1609 days
CVSS: 9.1 CRITICAL
EPSS (30-day exploit probability): 96.0% · top 1% of all CVEs
Weakness: CWE-22
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.