ACTIVELY EXPLOITED
CVE-2018-7445: MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
| Vendor | MikroTik |
|---|---|
| Product | RouterOS |
| Actively exploited | Yes |
| Added to CISA KEV | 8 Sep 2022 |
| CISA federal deadline | 29 Sep 2022 |
| Weakness (CWE) | CWE-119 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.
SOURCES
Other MikroTik flaws
- CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
- CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
- CVE-2018-14847: MikroTik Router OS Directory Traversal Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.