MikroTik · RouterOS
CVE-2018-14847
MikroTik Router OS Directory Traversal Vulnerability
Exploited in attacks
Critical 9.1 Attack chance: 96%
What it is
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 1, 2022
- Added to the CISA list
- December 1, 2021
- Published
- August 2, 2018
- Severity
- Critical 9.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 96% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (8)
- https://www.exploit-db.com/exploits/45578/
- https://github.com/BigNerd95/WinboxExploit
- https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf
- https://github.com/BasuCert/WinboxPoC
- https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847
- https://n0p.me/winbox-bug-dissection/
- https://github.com/tenable/routeros/tree/master/poc/bytheway
- https://mikrotik.com/supportsec/winbox-vulnerability
More exploited flaws from MikroTik
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 25, 2026 | Improper Enforcement of Behavioral Workflow | RouterOS | Medium 6.9 | 2.3% |
| Sep 10, 2026 | Missing Authentication for Critical Function | RouterOS | High 8.8 | 1.6% |
| Sep 10, 2026 | Improper Neutralization of Argument Delimiters in a Command | RouterOS | Critical 9.2 | 6.4% |
| Sep 8, 2022 | Stack-Based Buffer Overflow | RouterOS | Critical 9.8 | 66% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.