CVE-2018-7445
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
Description
CVE-2018-7445 is a stack-based buffer overflow vulnerability in MikroTik RouterOS that occurs when processing NetBIOS session request messages. Remote attackers with access to the SMB service can exploit this flaw to execute arbitrary code on the affected system, potentially gaining full control of the router. The vulnerability is particularly dangerous because MikroTik routers are widely deployed in enterprise and ISP environments, making them high-value targets for network intrusion. CISA has added CVE-2018-7445 to its Known Exploited Vulnerabilities catalog, and with an exceptionally high EPSS score of 85.9% (99th percentile), the probability of exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mikrotik | routeros | < 6.41.3; 6.42 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2018/Mar/38(Exploit, Mailing List, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/103427(Third Party Advisory, VDB Entry)
- https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow(Exploit, Third Party Advisory)
- https://www.exploit-db.com/exploits/44290/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7445(US Government Resource)
Weakness Type
CWE-121: Stack-based Buffer Overflow
CVE-2018-7445 exploits a stack-based buffer overflow in MikroTik RouterOS's SMB service, where the processing of NetBIOS session request messages fails to properly check the size of incoming data before copying it to a stack-allocated buffer. When data exceeding the buffer's allocated size is written to the stack, it overwrites adjacent memory including return addresses, enabling the attacker to redirect execution flow and achieve arbitrary code execution.
Learn more: CWE-121 — Stack-based Buffer Overflow
Impact Analysis
CVE-2018-7445 poses a critical risk to network infrastructure. The vulnerability is remotely exploitable without requiring authentication, meaning any attacker with network access to the SMB service on a MikroTik router can trigger the buffer overflow. No user interaction is needed, and the attack complexity is low once the service is reachable. Successful exploitation grants the attacker arbitrary code execution on the router, which could lead to complete compromise of network traffic routing, interception of sensitive data passing through the device, deployment of persistent backdoors, or use of the compromised router as a pivot point for further attacks within the network. With an EPSS score of 85.9% (99th percentile), this vulnerability is among the most likely to be exploited across all known vulnerabilities, underscoring the urgency of patching or mitigating affected MikroTik devices.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2018-7445 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 29, 2022. The EPSS score of 85.9% (99th percentile) indicates a near-certain probability of exploitation, reflecting widespread availability of exploit techniques for this vulnerability. Public exploit information is available through security advisories from Core Security, who originally discovered and reported the vulnerability. No ransomware campaigns have been specifically associated with this CVE, but compromised routers are frequently used as infrastructure for various cybercriminal operations including traffic interception and botnet participation.
Remediation
- Update MikroTik RouterOS immediately: Apply the vendor-supplied patches as per the CISA KEV required action. MikroTik has released firmware updates that address the stack-based buffer overflow in the SMB service.
- Disable the SMB service if not required: On MikroTik routers where Windows file sharing via SMB is unnecessary, disable the SMB service entirely to eliminate the attack vector. This can be done via the RouterOS CLI with 'ip smb set enabled=no'.
- Restrict network access to management services: Configure firewall rules on the MikroTik device to limit access to the SMB service (TCP port 445) and other management interfaces to trusted IP addresses only, preventing unauthorized remote exploitation.
- Implement network segmentation: Place MikroTik routers behind additional firewall layers and segment management traffic from production traffic to contain potential compromise.
- Monitor router logs for anomalous behavior: Review MikroTik system logs for signs of exploitation attempts, unexpected reboots, configuration changes, or unusual network traffic patterns that could indicate a compromised device.
Technical Details
CVE-2018-7445 is a classic stack-based buffer overflow in MikroTik RouterOS's implementation of the SMB (Server Message Block) protocol, specifically in the handling of NetBIOS session request messages. When the SMB service receives a NetBIOS session request, it copies the incoming session request data into a stack-allocated buffer without adequately checking the length of the input. An attacker can craft a specially formatted NetBIOS session request with an oversized payload that overflows the buffer, overwriting the saved return address on the stack. By controlling the return address, the attacker can redirect program execution to attacker-supplied shellcode, achieving remote code execution with the privileges of the SMB service process. The vulnerability requires no authentication, as NetBIOS session setup occurs before any SMB authentication exchange, making it exploitable by any network client that can reach TCP port 445 on the router.
Frequently Asked Questions
Is CVE-2018-7445 being actively exploited?
Yes. CISA has added CVE-2018-7445 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 85.9% placing it in the 99th percentile, exploitation is near-certain for exposed devices. No specific ransomware campaigns are currently associated with this vulnerability.
What products are affected by CVE-2018-7445?
CVE-2018-7445 affects MikroTik RouterOS devices with the SMB service enabled. The vulnerability is present in RouterOS versions prior to the security patches released by MikroTik. All router models running vulnerable firmware versions are affected when the SMB service is accessible.
How do I fix CVE-2018-7445?
Update MikroTik RouterOS to the latest patched firmware version. If immediate patching is not possible, disable the SMB service on affected routers or restrict network access to TCP port 445 using firewall rules to limit exposure to trusted management networks only.
How severe is CVE-2018-7445?
CVE-2018-7445 is a critical severity vulnerability that enables remote code execution without authentication on MikroTik routers. The EPSS score of 85.9% (99th percentile) indicates near-certain exploitation probability. Successful exploitation grants complete control over the router, posing severe risks to network infrastructure security.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.