MikroTik Router OS Directory Traversal Vulnerability (CVE-2018-14847)

What is affected, what to do

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• MikroTik RouterOS lte *..6.42

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade RouterOS to a fixed release: at minimum 6.42.1 (Bugfix channel) or 6.43 (Current channel), ideally the latest supported Long-Term version. Push via WinBox → System → Packages → Check for Updates or CLI /system package update install.
   • Remove WinBox (TCP 8291) from the public internet immediately: upstream firewall drop for inbound 8291/tcp on all WAN interfaces and restrict on the device itself with /ip service set winbox address=<mgmt-subnet>.
   • Rotate every local RouterOS credential (/user set admin password=...), including service accounts; rename or disable the default admin user. The flaw exposes the user database, so pre-patch passwords must be treated as compromised.
   • Audit for persistence: inspect /system scheduler print, /system scripts print, /tool fetch jobs, SOCKS proxy (/ip socks print), web proxy, L2TP/PPTP server state and unexpected NAT/redirect rules (notably to 443 or 8291), then remove anything you did not provision.
   • If patching has to wait, disable WinBox entirely (/ip service disable winbox) and administer only via SSH tunnelled over a management VPN.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: isolate every MikroTik management interface into a dedicated out-of-band or jump-host VLAN; on the WAN side allow only ICMP/ESP and the tunnel ports you actually need — never 8291, 8728 (API), 8729 (API-SSL), 80 or 443 to the router's public IP.
   • Perimeter ACL: explicit deny on 8291/tcp, 8728/tcp, 8729/tcp from the internet; GeoIP filtering on management ports where admin traffic is regionally bounded.
   • IPS/IDS: enable Suricata/Snort signatures covering CVE-2018-14847 and the associated By The Way / Chimay-Red exploit patterns (available in ET Open with MikroTik Winbox in the rule name); inspect internal 8291/tcp traffic as well.
   • Device hardening: /ip firewall filter action=drop in-interface=<wan> protocol=tcp dst-port=8291, disable Bandwidth Test server, Romon, MAC-WinBox (/tool mac-server) and neighbour discovery on WAN interface lists.
   • IAM/least privilege: scoped admin group (/user group), MFA-gated jump host in front of the router, disable API and API-SSL services where unused.
   • Configuration baseline: after patching, redeploy configuration from a known-good source; backups taken before the patch window are suspect and should not be restored blindly.
3. 03

   Runbook step 3

   Detection rules

   • Netflow/Zeek: any inbound connection to 8291/tcp from an external source towards your own router IPs is an incident. Zeek filter: conn.log where id.resp_p == 8291 && !Site::is_local_addr(id.orig_h).
   • Suricata/Snort: enable ET Open signatures referencing MikroTik Winbox and triage any binary POST-like payloads to 8291/tcp.
   • RouterOS logs shipped to SIEM via syslog: unexpected successful admin logins outside maintenance windows, new user creation (system,info,account topic), unusual /tool fetch invocations, new scheduler entries.
   • EDR/proxy telemetry: client egress to known cryptomining pools or the CoinHive-successor JavaScript that was historically injected through compromised MikroTik web proxies — a strong signal that a router further upstream is still owned.
   • Sigma shape (network): detection: selection: dst_port: 8291, direction: inbound, src_zone: untrust; condition: selection — run as a hunting query against perimeter logs in Splunk/Elastic.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• MikroTik MikroTik RouterOS

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

References & sources

• exploit-db.com45578Exploit, Exploit, Third-party advisory, Vulnerability database
• github.comBigNerd95/WinboxExploitExploit, Mitigation, Third-party advisory
• github.comtenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2…Broken link, Exploit, Third-party advisory
• github.comBasuCert/WinboxPoCExploit, Mitigation, Third-party advisory
• github.comtenable/routeros/tree/master/poc/cve_2018_14847Exploit, Third-party advisory
• n0p.mewinbox-bug-dissectionExploit, Third-party advisory
• github.comtenable/routeros/tree/master/poc/bythewayExploit, Third-party advisory
• mikrotik.comsupportsec/winbox-vulnerabilityVendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847government-resource, US government resource