CVE-2018-14847
MikroTik Router OS Directory Traversal Vulnerability
Description
CVE-2018-14847 is a critical-severity path traversal vulnerability in MikroTik RouterOS through version 6.42, exploitable through the WinBox management interface. The flaw allows unauthenticated remote attackers to read arbitrary files from the router's filesystem, and authenticated attackers to write arbitrary files, by leveraging directory traversal sequences in WinBox requests. This vulnerability is particularly dangerous because reading the router's user database file enables attackers to extract credentials and gain full administrative control. CISA has added CVE-2018-14847 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 92.84% (99.76th percentile) indicates near-certain exploitation activity targeting MikroTik routers worldwide.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mikrotik | routeros | <= 6.42 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/BasuCert/WinboxPoC(Exploit, Mitigation, Third Party Advisory)
- https://github.com/BigNerd95/WinboxExploit(Exploit, Mitigation, Third Party Advisory)
- https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf(Broken Link, Exploit, Third Party Advisory)
- https://github.com/tenable/routeros/tree/master/poc/bytheway(Exploit, Third Party Advisory)
- https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847(Exploit, Third Party Advisory)
- https://mikrotik.com/supportsec/winbox-vulnerability(Vendor Advisory)
- https://n0p.me/winbox-bug-dissection/(Exploit, Third Party Advisory)
- https://www.exploit-db.com/exploits/45578/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
In MikroTik RouterOS, path traversal manifests through the WinBox interface, which fails to properly sanitize file path parameters in management protocol requests. An attacker can use directory traversal sequences to escape the intended directory and access arbitrary files on the router's filesystem. This enables reading of sensitive files such as the user credential database, and for authenticated users, writing arbitrary files to gain persistent access or modify router configuration.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2018-14847 carries a CVSS 3.1 score of 9.1 (CRITICAL), reflecting an extremely severe and easily exploitable threat. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication for file reading, and needs no user interaction. Successful exploitation severely compromises confidentiality and integrity, enabling attackers to read any file on the router including credential databases and configuration files, and to write arbitrary files that can modify router behavior. Although the availability impact is rated NONE in the CVSS vector, the practical impact extends far beyond the router itself, as compromised MikroTik devices have been weaponized for cryptojacking, traffic interception, and as pivot points for lateral movement into enterprise networks. With an EPSS score of 92.84%, this vulnerability is among the most actively exploited router vulnerabilities, affecting hundreds of thousands of internet-facing MikroTik devices.
Exploit Maturity
CVE-2018-14847 has an extensively developed and publicly available exploit ecosystem. Public exploit code is available through multiple sources including Exploit-DB, WinboxPoC on GitHub, WinboxExploit on GitHub, and Tenable's PoC repository. A detailed technical dissection is also available at n0p.me. CISA has confirmed active exploitation in the wild by listing this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-06-01. The EPSS score of 92.84% indicates near-certain exploitation activity, and this vulnerability has been widely used in mass scanning campaigns to compromise internet-facing MikroTik routers for cryptojacking and botnet operations.
Remediation
- Update MikroTik RouterOS to a version newer than 6.42 as directed by CISA KEV: Apply updates per vendor instructions. MikroTik released patches addressing this vulnerability, and all affected routers should be upgraded immediately.
- Verify all MikroTik RouterOS installations running version 6.42 or earlier have been updated. Use the MikroTik WinBox or SSH interface to check the current version and apply upgrades from the MikroTik download portal.
- Restrict access to the WinBox management interface (TCP port 8291) by configuring firewall rules to allow connections only from trusted management IP addresses. Never expose WinBox to the public internet.
- After updating, change all router user passwords immediately, as credentials may have been extracted via the file-read vulnerability prior to patching. Review the router's user list for unauthorized accounts and check the scheduled scripts for malicious entries.
- Monitor router logs and configurations for signs of compromise including unauthorized DNS settings changes (commonly used in DNS hijacking attacks), unexpected SOCKS proxy configurations, and scheduled scripts that download or execute external payloads.
Technical Details
CVE-2018-14847 exploits a directory traversal flaw in the WinBox management protocol of MikroTik RouterOS through version 6.42. The WinBox interface listens on TCP port 8291 and processes management requests that include file path parameters. The vulnerability exists because the request handler does not properly sanitize path components, allowing attackers to include directory traversal sequences that escape the intended directory scope. An unauthenticated attacker can read arbitrary files, most critically the user database file which contains router credentials in a recoverable format. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no authentication and is trivially exploitable remotely, with high impact on both confidentiality (arbitrary file read) and integrity (authenticated file write). The two-stage attack pattern — first reading credentials without authentication, then using those credentials to write arbitrary files — effectively gives unauthenticated attackers full control over the router despite the nominal privilege requirement difference between read and write operations.
Frequently Asked Questions
Is CVE-2018-14847 being actively exploited?
Yes. CVE-2018-14847 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 92.84% (99.76th percentile) places it among the most actively exploited vulnerabilities. Multiple mass scanning campaigns have targeted internet-facing MikroTik routers using publicly available exploit tools.
What products are affected by CVE-2018-14847?
CVE-2018-14847 affects MikroTik RouterOS version 6.42 and earlier. All MikroTik router models running affected firmware versions are vulnerable through the WinBox management interface on TCP port 8291.
How do I fix CVE-2018-14847?
Update MikroTik RouterOS to a version newer than 6.42. After updating, immediately change all router user passwords as they may have been compromised. Restrict WinBox access to trusted management networks using firewall rules and review router configurations for signs of compromise.
How severe is CVE-2018-14847?
CVE-2018-14847 has a CVSS 3.1 score of 9.1 (CRITICAL). It allows unauthenticated remote attackers to read any file on the router, including the credential database, effectively enabling full router compromise. The 92.84% EPSS score confirms it is one of the most exploited router vulnerabilities worldwide.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.