CVE-2018-14847: MikroTik RouterOS WinBox directory traversal allows file read and write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.1, CISA KEV listing, near-maximum EPSS, and public exploit code make this an actively exploited critical flaw.

What it is

MikroTik RouterOS through 6.42 contains a directory traversal flaw in the WinBox interface. Unauthenticated remote attackers can read arbitrary files, and authenticated attackers can write arbitrary files. Because WinBox is a management interface, this exposes sensitive configuration and credential material on internet-facing routers.

Impact

An unauthenticated attacker can read arbitrary files, including router configuration and stored credentials, enabling full device compromise. An authenticated attacker can write arbitrary files, which can lead to code execution or persistent modification of the device.

Attack surface

Reachable over the network through the WinBox interface (TCP 8291) with no authentication required for the file-read path; the file-write path requires valid credentials. No user interaction is needed per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2018-14847 is listed in CISA KEV (added 2021-12-01) and has an EPSS 30-day probability of 0.96087 (99.875th percentile), with multiple public exploit references tagged Exploit. This indicates active, widespread exploitation and readily available exploit code.

What to do

• Upgrade MikroTik RouterOS to a version later than 6.42 per the vendor advisory.
• Disable or restrict the WinBox service on untrusted networks; block TCP 8291 from the internet.
• Restrict management access to a dedicated management VLAN or trusted IP allowlist.
• Rotate credentials and review router configuration for unauthorized changes after exposure.
• Monitor vendor advisories and apply updates promptly for any remaining RouterOS devices.

Detection

• Monitor network traffic to TCP 8291 for unexpected or external connections to WinBox.
• Audit RouterOS logs and configuration for unauthorized file access or modification events.
• Search for known exploit artifacts or indicators associated with public WinBox PoCs.
• Inventory RouterOS devices and verify versions are above 6.42.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.