ACTIVELY EXPLOITED
CVE-2018-14847: MikroTik Router OS Directory Traversal Vulnerability
| Vendor | MikroTik |
|---|---|
| Product | RouterOS |
| Actively exploited | Yes |
| Added to CISA KEV | 1 Dec 2021 |
| CISA federal deadline | 1 Jun 2022 |
| Weakness (CWE) | CWE-22 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
SOURCES
Other MikroTik flaws
- CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
- CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
- CVE-2018-7445: MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.