{"id":"CVE-2018-14847","published":"2018-08-02T07:29:00Z","modified":"2026-06-17T01:41:44Z","title":"MikroTik Router OS Directory Traversal Vulnerability","vendor":"MikroTik","product":"RouterOS","tier":"core","eol":null,"description":{"text":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","provenance":"source","from":"NVD"},"summary":{"text":"A directory traversal flaw in the WinBox management interface of MikroTik RouterOS, affecting versions through 6.42, lets attackers escape the intended directory structure when accessing files. An unauthenticated attacker with network access to WinBox can read arbitrary files, while a remote attacker who has authenticated can write arbitrary files, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:31Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.95981,"percentile":0.99874,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-12-01","dueDate":"2022-06-01","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-14847","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-12-01","exploitedFirstSeen":"2020-12-01","ransomware":false,"evidence":[{"url":"https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware","date":"2020-12-01"},{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"},{"url":"https://blog.mikrotik.com/security/meris-botnet.html","date":"2021-09-15"},{"url":"https://blog.cloudflare.com/meris-botnet/","date":"2021-11-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-12-01"},{"url":"https://www.microsoft.com/en-us/security/blog/2022/03/16/uncovering-trickbots-use-of-iot-devices-in-command-and-control-infrastructure/","date":"2022-03-16"},{"url":"https://www.bleepingcomputer.com/news/security/microsoft-creates-tool-to-scan-mikrotik-routers-for-trickbot-infections/","date":"2022-03-17"},{"url":"https://decoded.avast.io/martinhron/meris-and-trickbot-standing-on-the-shoulders-of-giants/","date":"2022-03-18"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-158a","date":"2022-06-07"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-158a","date":"2022-06-10"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Ukraine's State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell","url":"https://otx.alienvault.com/pulse/6ad9e265c99769b3a212171f","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Ukraine's State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell","url":"https://otx.alienvault.com/pulse/6ad791051c8d94c4c32e8ad7","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/BasuCert/WinboxPoC","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/BigNerd95/WinboxExploit","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/tree/master/poc/bytheway","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847","tags":["Exploit","Third Party Advisory"]},{"url":"https://mikrotik.com/supportsec/winbox-vulnerability","tags":["Vendor Advisory"]},{"url":"https://n0p.me/winbox-bug-dissection/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/45578/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/BasuCert/WinboxPoC","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/BigNerd95/WinboxExploit","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/tree/master/poc/bytheway","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847","tags":["Exploit","Third Party Advisory"]},{"url":"https://n0p.me/winbox-bug-dissection/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/45578/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploit of public-facing WinBox interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows unauthenticated remote attackers to read arbitrary files","start":31,"end":94}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary file read from device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows unauthenticated remote attackers to read arbitrary files","start":31,"end":94}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-6729","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-6729","exploited":true,"exploitedSince":"2021-12-01","provenance":"source"},"exploits":[{"id":45578,"url":"https://www.exploit-db.com/exploits/45578","title":"MicroTik RouterOS < 6.43rc3 - Remote Root","type":"remote","platform":"hardware","date":"2018-10-10","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-10-10"},"pocGithub":{"count":14,"skipped":0,"earliest":"2018-06-24","earliestUrl":"https://github.com/BasuCert/WinboxPoC","repos":[{"name":"BasuCert/WinboxPoC","url":"https://github.com/BasuCert/WinboxPoC","stars":519,"created":"2018-06-24"},{"name":"hacker30468/Mikrotik-router-hack","url":"https://github.com/hacker30468/Mikrotik-router-hack","stars":54,"created":"2021-04-21"},{"name":"jas502n/CVE-2018-14847","url":"https://github.com/jas502n/CVE-2018-14847","stars":30,"created":"2018-12-15"},{"name":"sinichi449/Python-MikrotikLoginExploit","url":"https://github.com/sinichi449/Python-MikrotikLoginExploit","stars":21,"created":"2019-09-29"},{"name":"syrex1013/MikroRoot","url":"https://github.com/syrex1013/MikroRoot","stars":15,"created":"2018-10-13"}]},"metasploit":[{"name":"Mikrotik Winbox Arbitrary File Read","module":"auxiliary/gather/mikrotik_winbox_fileread","type":"auxiliary","disclosureDate":"2018-08-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/mikrotik_winbox_fileread.py"}],"first":{"date":"2018-06-24","source":"PoC-in-GitHub","url":"https://github.com/BasuCert/WinboxPoC"},"provenance":"source"},"exploitRefs":["https://github.com/BasuCert/WinboxPoC","https://github.com/BigNerd95/WinboxExploit","https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf","https://github.com/tenable/routeros/tree/master/poc/bytheway","https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847","https://n0p.me/winbox-bug-dissection/","https://www.exploit-db.com/exploits/45578/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"},{"stage":"related","techniques":["T1078"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-06-24","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2018-08-02, Exploit-DB 2018-10-10","url":"https://github.com/BasuCert/WinboxPoC","provenance":"source"},{"date":"2018-08-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14847","provenance":"source"},{"date":"2020-12-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware","provenance":"source"},{"date":"2021-12-01","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-12-01","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-6729","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1217},"priority":{"score":69.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2159 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 NVD references tagged Exploit; 1 Exploit-DB entry; 14 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}