CVE-2018-7445

What is MikroTik RouterOS?

RouterOS is the embedded operating system that powers MikroTik's widely deployed line of routers, used by ISPs, small businesses, and home users worldwide for routing, wireless, and network management. MikroTik devices are prized for their low cost and flexibility, which has made them extremely common at the network edge — and also a frequent target for internet-wide scanning, since a compromised router sits in a privileged position between a network and the internet.

Overview

CVE-2018-7445 is a stack-based buffer overflow in RouterOS's handling of SMB (Server Message Block) protocol messages, specifically in the processing of NetBIOS session request packets. A remote, unauthenticated attacker who can reach the SMB service can send a crafted session request that overflows a stack buffer, corrupting the call stack and potentially achieving arbitrary code execution on the router. With a CVSS score of 9.8 (Critical) and no authentication or user interaction required, this is one of the more severe MikroTik vulnerabilities disclosed to date.

Affected Versions

Technical Details

The vulnerability is a classic stack buffer overflow (CWE-119): RouterOS's SMB implementation does not properly bound-check data copied from an incoming NetBIOS session request message before writing it into a fixed-size stack buffer. An attacker-controlled payload longer than the expected size overwrites adjacent stack memory, including saved return addresses, which can be leveraged to redirect execution and run attacker-supplied code. Exploitation requires only network reachability to the SMB service — no credentials and no user interaction.

Discovery

The vulnerability was identified and disclosed by researchers at Core Security, who published a technical advisory describing the SMB buffer overflow alongside MikroTik's own patched RouterOS releases.

Exploitation Context

This bug is closely associated with the exploit chain known as "Chimay Red," which was used as one of the initial infection vectors for the VPNFilter malware disclosed by Cisco Talos in May 2018. VPNFilter compromised hundreds of thousands of consumer and small-office routers and network storage devices worldwide, including many MikroTik devices, to build a multi-stage botnet capable of traffic interception, credential theft, and destructive "kill" commands. CISA added CVE-2018-7445 to the KEV catalog in September 2022 based on confirmed continued exploitation of unpatched devices.

Remediation

1. Upgrade RouterOS to a version that includes the 2018 SMB security fix — check MikroTik's changelog and download the latest stable release for your hardware.
2. Disable the SMB service on RouterOS devices entirely if file sharing over SMB is not required — this removes the attack surface outright.
3. Never expose RouterOS management or SMB services directly to the internet; restrict access to trusted internal networks or VPN only.
4. Audit existing MikroTik devices for signs of compromise (unexpected scheduler jobs, unfamiliar firewall rules, or unknown scripts), consistent with known VPNFilter indicators.
5. Change default credentials and disable unused services as a general hardening baseline for all RouterOS deployments.