by Kastro
Paper/Archive/CVE-2018-14847

CVE-2018-14847

MikroTik RouterOS — MikroTik Router OS Directory Traversal Vulnerability

KEV · due 1 JunEPSS 96%public exploitSSVC actCVSS 9.1
critical.is priorityof 100
97
CVSS 9.1 (ADP)9.1 / 10 × 3027.3In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/45578refgithub.com/BigNerd95/WinboxExploitrefgithub.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdfrefgithub.com/BasuCert/WinboxPoCrefgithub.com/tenable/routeros/tree/master/poc/cve_2018_14847refn0p.me/winbox-bug-dissectionrefgithub.com/tenable/routeros/tree/master/poc/bythewayrefmikrotik.com/supportsec/winbox-vulnerabilityrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847kevcisa.gov/known-exploited-vulnerabilities-catalog