ZeroDay Findings
Sign inSign up

Findings

CVE-2018-14847

MikroTik Router OS Directory Traversal Vulnerability

Published Aug 2, 2018 · updated Jun 16, 2026 · mikrotik routeros

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 2, 2018 · Catalog

    Detected

    MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

  2. Dec 1, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 1, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Required action

Apply updates per vendor instructions.

CISA due date Jun 1, 2022

Affected

  • cpe mikrotik/routerosversion unspecified
  • vendor MikroTik RouterOSversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2018-14847

    MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2018-14847

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2018-14847

    30-day exploitation probability 96.0%

    first.org
  • Exploit DatabasePublic exploit reference45578

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleauxiliary_gather/mikrotik_winbox_fileread

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2018-14847

    MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

    nvd.nist.gov

References