{"id":"CVE-2018-7445","published":"2018-03-19T21:29:01Z","modified":"2026-06-17T02:03:08Z","title":"MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability","vendor":"MikroTik","product":"RouterOS","tier":"core","eol":null,"description":{"text":"A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.","provenance":"source","from":"NVD"},"summary":{"text":"A stack-based buffer overflow in MikroTik RouterOS's SMB service, triggered while parsing NetBIOS session request messages, allows code execution on the device. An unauthenticated remote attacker with network access to the SMB service can exploit it without any user interaction, since the overflow occurs before authentication takes place.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:59Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.65828,"percentile":0.99266,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-09-08","dueDate":"2022-09-29","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.coresecurity.com/core-labs/advisories/mikrotik-routeros-smb-buffer-overflow#vendor_update, https://mikrotik.com/download; https://nvd.nist.gov/vuln/detail/CVE-2018-7445","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-12-01","exploitedFirstSeen":"2020-12-01","ransomware":false,"evidence":[{"url":"https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware","date":"2020-12-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-09-08"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Mar/38","tags":["Exploit","Mailing List","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/103427","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44290/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2018/Mar/38","tags":["Exploit","Mailing List","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/103427","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44290/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7445","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote exploitation of exposed SMB service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it","start":229,"end":354}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Overflow yields arbitrary code execution on router","mappingType":"primary_impact","evidence":[{"from":"description","quote":"gain code execution on the system","start":194,"end":227}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-19176","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-19176","exploited":true,"exploitedSince":"2022-09-08","provenance":"source"},"exploits":[{"id":44290,"url":"https://www.exploit-db.com/exploits/44290","title":"MikroTik RouterOS < 6.41.3/6.42rc27 - SMB Buffer Overflow","type":"remote","platform":"hardware","date":"2018-03-15","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-03-15"},"first":{"date":"2018-03-15","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/44290"},"provenance":"source"},"exploitRefs":["http://seclists.org/fulldisclosure/2018/Mar/38","https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow","https://www.exploit-db.com/exploits/44290/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2018-03-15","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-44290)","url":"https://www.exploit-db.com/exploits/44290","provenance":"source"},{"date":"2018-03-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7445","provenance":"source"},{"date":"2020-12-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware","provenance":"source"},{"date":"2022-09-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-09-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-19176","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":1634},"priority":{"score":69.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2158 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9927"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}