CVE-2018-14847

What is MikroTik RouterOS?

RouterOS is the operating system that powers MikroTik's widely deployed line of routers, used by ISPs, enterprises, and hobbyists alike for its low cost and extensive feature set. Winbox is MikroTik's proprietary configuration protocol/tool, allowing administrators to manage RouterOS devices over a binary TCP protocol rather than the web UI or SSH. Because MikroTik hardware is deployed in huge numbers globally, including as core ISP infrastructure, a remotely exploitable flaw in RouterOS has enormous scale and downstream network impact.

Overview

CVE-2018-14847 is a directory traversal vulnerability in RouterOS's handling of the Winbox management protocol, present in versions through 6.42. It allows an unauthenticated remote attacker to read arbitrary files from the device filesystem — most critically, the user database file containing admin credentials — and allows an authenticated attacker to write arbitrary files. Reading the credentials file effectively grants an attacker full administrative access to the router without ever needing valid login credentials to start.

Technical Details

The flaw (CWE-22, Path Traversal) exists in how the Winbox service resolves file paths requested over its binary protocol; a specially crafted request can escape the intended directory and reach arbitrary files on the device, including /nova/etc/user.dat where local user credentials are stored. Because Winbox is often left open on the router's WAN interface for remote administration convenience, this file-read primitive is trivially converted into full unauthenticated device takeover: read the credentials, log in as admin, then use the write-arbitrary-file primitive (or router-level "write config" features) to plant further backdoors or scripts.

Discovery

The underlying class of RouterOS/Winbox vulnerabilities came to wide public attention through Kaspersky's GReAT research team, who in 2018 documented the "Slingshot" advanced persistent threat campaign that used compromised MikroTik routers as an infection vector. MikroTik addressed the specific directory traversal flaw in RouterOS updates released around the same period.

Exploitation Context

This vulnerability has been one of the most widely and persistently exploited router bugs in the KEV catalog. It was abused at scale by cryptomining botnets and other opportunistic campaigns that scanned the internet for exposed Winbox ports (TCP 8291), harvested admin credentials, and reconfigured routers — sometimes to inject cryptomining JavaScript into web traffic passing through the device, sometimes purely for botnet recruitment. Its association with the Slingshot APT campaign underscores that both opportunistic criminal actors and sophisticated nation-state-linked operators have exploited this class of MikroTik flaw.

Remediation

1. Upgrade RouterOS to a version beyond 6.42 (or the current supported release) that fixes this Winbox directory traversal issue.
2. Disable Winbox access on the WAN/internet-facing interface; restrict administrative access to trusted internal networks or a VPN.
3. Change all administrative passwords on any device that was ever exposed while running a vulnerable RouterOS version, since credentials may have already been harvested.
4. Audit router configuration for unauthorized changes — scheduler scripts, unknown users, or altered firewall/NAT rules are common signs of prior compromise.
5. Restrict or firewall the Winbox port (TCP 8291) at the network edge if the service must remain enabled for legitimate management.