Back to Database
Status published
Unknown
CVE-2018-14847
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read...
Vulnerability Description
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-14847
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.exploit-db.com/exploits/45578/
- https://github.com/BigNerd95/WinboxExploit
- https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf
- https://github.com/BasuCert/WinboxPoC
- https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847
- https://n0p.me/winbox-bug-dissection/
- https://github.com/tenable/routeros/tree/master/poc/bytheway
- https://mikrotik.com/supportsec/winbox-vulnerability
More from mikrotik
View All →CVE-2022-45313
Mikrotik RouterOs before stable v7.5 was discovered to contain an...
Unknown
0
CVE-2022-36522
Mikrotik RouterOs through stable v6.48.3 was discovered to contain an...
Medium
6.5
CVE-2022-34960
The container package in MikroTik RouterOS 7.4beta4 allows an attacker...
Critical
9.8
CVE-2021-41987
In the SCEP Server of RouterOS in certain Mikrotik products,...
High
8.1
CVE-2021-3014
In MikroTik RouterOS through 2021-01-04, the hotspot login page is...
Medium
6.1
Affected Vendor
mikrotik
View all reports →Affected Software
routeros
Vulnerable Versions:
0
Timeline
Official Publish:
August 2nd, 2018
Last Modified:
October 21st, 2025
Added to House:
July 20th, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.