KEVIntel
Back to KEVs
9.1
CVSS
Critical

CVE-2018-14847

PUBLISHED

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write...

Exploited in the wild Remote Low complexity No user interaction
Vendor
MikroTik
Product
RouterOS
Published
Aug 02, 2018
EPSS
—

Description

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

windows cisa edge nessus_scanner

CVSS scores

CVSS v3.1 9.1 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0 6.4

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitation status

Exploited in the wild

Recorded 2021-12-01 00:00:00 UTC · Source

SSVC decision points

Exploitation
active
Automatable
Yes
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Dec 01, 2021
CISA Dec 01, 2021

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

tausifzaman/CVE-2018-14847

github · Created 2025-04-16 18:37:08 UTC · 0 stars

This is a proof of concept of the critical WinBox vulnerability (CVE-2018-14847) which allows for arbitrary file read of plain text passwords. The vulnerability has long since been fixed, so this project has ended and will not be supported or updated anymore. You can fork it and update it yourself instead.

K3ysTr0K3R/CVE-2018-14847-EXPLOIT

github · Created 2024-04-22 22:33:25 UTC · 2 stars

A PoC exploit for CVE-2018-14847 - MikroTik WinBox File Read

babyshen/routeros-CVE-2018-14847-bytheway

github · Created 2022-10-31 06:38:11 UTC · 4 stars

By the Way is an exploit that enables a root shell on Mikrotik devices running RouterOS versions:

yukar1z0e/CVE-2018-14847

github · Created 2020-04-29 01:40:33 UTC · 1 stars

jas502n/CVE-2018-14847

github · Created 2018-12-15 10:38:26 UTC · 27 stars

MikroTik RouterOS Winbox未经身份验证的任意文件读/写漏洞

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Added to KEVIntel