CVE-2018-7445
CriticalActively exploited (CISA KEV)
Description
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.
SeverityCritical
CVSS9.8
Exploit probability—
Product
MikroTik RouterOS
PublishedMar 19, 2018
First seenMar 19, 2018
Added to KEVSep 8, 2022
Weakness typeCWE-119Memory buffer bounds error
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Sep 29, 2022Update
- mikrotik routeros6.41.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mikrotik routeros | v < 6.41.3, 6.42 | 6.41.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.