{"id":"CVE-2018-14847","aliases":["EUVD-2018-6729","GHSA-j583-4cfp-xf9m"],"status":"published","title":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files...","description":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.95981,"percentile":0.99875,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2018-08-02T07:00:00Z","modified":"2026-06-17T01:41:44Z","kev":{"date_added":"2021-12-01","due_date":"2022-06-01","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-12-01"},{"source":"kev","since":"2021-12-01"}],"exploits":[{"source":"pocgithub","id":"BasuCert/WinboxPoC","title":"BasuCert/WinboxPoC","date":"2018-06-24","url":"https://github.com/BasuCert/WinboxPoC"},{"source":"pocgithub","id":"msterusky/WinboxExploit","title":"msterusky/WinboxExploit","date":"2018-09-11","url":"https://github.com/msterusky/WinboxExploit"},{"source":"exploitdb","id":"EDB-45578","title":"MicroTik RouterOS \u003c 6.43rc3 - Remote Root","type":"remote","platform":"hardware","date":"2018-10-10","url":"https://www.exploit-db.com/exploits/45578"},{"source":"pocgithub","id":"syrex1013/MikroRoot","title":"syrex1013/MikroRoot","date":"2018-10-13","url":"https://github.com/syrex1013/MikroRoot"},{"source":"pocgithub","id":"jas502n/CVE-2018-14847","title":"jas502n/CVE-2018-14847","date":"2018-12-15","url":"https://github.com/jas502n/CVE-2018-14847"},{"source":"pocgithub","id":"mahmoodsabir/mikrotik-beast","title":"mahmoodsabir/mikrotik-beast","date":"2019-05-26","url":"https://github.com/mahmoodsabir/mikrotik-beast"},{"source":"pocgithub","id":"Tr33-He11/winboxPOC","title":"Tr33-He11/winboxPOC","date":"2019-09-25","url":"https://github.com/Tr33-He11/winboxPOC"},{"source":"pocgithub","id":"sinichi449/Python-MikrotikLoginExploit","title":"sinichi449/Python-MikrotikLoginExploit","date":"2019-09-29","url":"https://github.com/sinichi449/Python-MikrotikLoginExploit"},{"source":"pocgithub","id":"yukar1z0e/CVE-2018-14847","title":"yukar1z0e/CVE-2018-14847","date":"2020-04-29","url":"https://github.com/yukar1z0e/CVE-2018-14847"},{"source":"pocgithub","id":"hacker30468/Mikrotik-router-hack","title":"hacker30468/Mikrotik-router-hack","date":"2021-04-21","url":"https://github.com/hacker30468/Mikrotik-router-hack"},{"source":"pocgithub","id":"babyshen/routeros-CVE-2018-14847-bytheway","title":"babyshen/routeros-CVE-2018-14847-bytheway","date":"2022-10-31","url":"https://github.com/babyshen/routeros-CVE-2018-14847-bytheway"},{"source":"pocgithub","id":"tausifzaman/CVE-2018-14847","title":"tausifzaman/CVE-2018-14847","date":"2025-04-16","url":"https://github.com/tausifzaman/CVE-2018-14847"},{"source":"pocgithub","id":"TheMalwareGuardian/CVE-2018-14847","title":"TheMalwareGuardian/CVE-2018-14847","date":"2026-04-27","url":"https://github.com/TheMalwareGuardian/CVE-2018-14847"},{"source":"pocgithub","id":"mourafuseti/VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS","title":"mourafuseti/VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS","date":"2026-05-20","url":"https://github.com/mourafuseti/VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS"},{"source":"pocgithub","id":"luel-4013/misfortune-cookie","title":"luel-4013/misfortune-cookie","date":"2026-09-07","url":"https://github.com/luel-4013/misfortune-cookie"},{"source":"metasploit","id":"auxiliary/gather/mikrotik_winbox_fileread","title":"Mikrotik Winbox Arbitrary File Read","type":"auxiliary","date":"2018-08-02","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/mikrotik_winbox_fileread"}],"products":[{"vendor":"mikrotik","product":"routeros"}],"references":[{"url":"https://www.exploit-db.com/exploits/45578/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/BigNerd95/WinboxExploit","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf","tags":["x_refsource_MISC","x_transferred","Broken Link","Exploit","Third Party Advisory"]},{"url":"https://github.com/BasuCert/WinboxPoC","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://n0p.me/winbox-bug-dissection/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/tenable/routeros/tree/master/poc/bytheway","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://mikrotik.com/supportsec/winbox-vulnerability","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14847"},{"url":"https://n0p.me/winbox-bug-dissection"},{"url":"https://www.exploit-db.com/exploits/45578"},{"url":"https://github.com/advisories/GHSA-j583-4cfp-xf9m"}],"sources":{"cve":[{"id":"CVE-2018-14847","description":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","status":"published","published":"2018-08-02T07:00:00Z","modified":"2025-10-21T23:45:49.372Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:00.948726Z"}],"euvd":[{"id":"EUVD-2018-6729","description":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","status":"published","published":"2018-08-02T07:00:00Z","modified":"2025-10-21T23:45:49Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"exploited_since":"2021-12-01","updated_at":"2026-11-02T20:31:23.427989Z"}],"ghsa":[{"id":"GHSA-j583-4cfp-xf9m","title":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files...","description":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","status":"published","published":"2022-05-14T01:28:26Z","modified":"2025-10-22T00:31:36Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2018-14847","title":"MikroTik Router OS Directory Traversal Vulnerability","description":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","cwes":["CWE-22"],"kev":{"date_added":"2021-12-01","due_date":"2022-06-01","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2018-14847","description":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","status":"published","published":"2018-08-02T07:29:00.28Z","modified":"2026-06-17T01:41:44.82Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:35.310988Z"}]}}