CVE-2018-7445: MikroTik RouterOS SMB pre-auth buffer overflow enabling code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityPre-auth remote code execution with a CVSS of 9.8, public exploit code and KEV listing makes this an urgent patch target.

What it is

MikroTik RouterOS contains a stack-based buffer overflow in its SMB service when handling NetBIOS session request messages. The overflow occurs before authentication, so any remote party that can reach the SMB service can attempt to corrupt memory and execute code. All architectures and devices running RouterOS before 6.41.3/6.42rc27 are affected.

Impact

An unauthenticated remote attacker can achieve code execution on the router, giving full control of the device, its traffic and its credentials. Because the flaw is pre-auth, no valid account is needed.

Attack surface

Reachable over the network via the SMB service (NetBIOS session request handling); CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction. Exposure requires the SMB service to be reachable from the attacker's network position.

Exploitation

Listed in CISA KEV since 2022-09-08 with a required action to apply vendor updates, and EPSS 30-day probability is 0.608 (99.1st percentile). Multiple references are tagged Exploit, including public advisories and an Exploit-DB entry, so working exploit code is publicly available.

What to do

• Upgrade RouterOS to 6.41.3/6.42rc27 or later as instructed by the vendor.
• If SMB is not required, disable the SMB service and block TCP/445 and NetBIOS ports at the network edge.
• Restrict management and SMB access to trusted management networks only; do not expose the service to the internet.
• Audit RouterOS devices for unauthorized configuration changes or persistence after any suspected exposure.
• Track KEV remediation deadlines and verify patched firmware versions across the fleet.

Detection

• Monitor for unexpected connections to TCP/445 or NetBIOS ports on RouterOS devices from untrusted sources.
• Alert on RouterOS SMB service crashes, reboots or abnormal process behavior that could indicate memory corruption attempts.
• Review device logs and configuration diffs for unauthorized changes, new users or scheduled tasks.
• Use network flow data to identify scanning or exploit traffic targeting SMB on MikroTik devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.