CVE-2018-14847
KEVCRITICAL 9.1EPSS 96.0%
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
- CVSS v3.1 NVD
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS v2.0 NVD
- 6.4 MEDIUM
AV:N/AC:L/Au:N/C:P/I:P/A:N - EPSS
- 95.98% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-12-01
- Published
- 2018-08-02
- Updated
- 2025-10-21
Proof-of-concept exploits (42)
- BasuCert/WinboxPoC519★ · 2020-10-16
- BigNerd95/WinboxExploit221★ · 2019-07-13
- tenable/routeros/tree/master/poc/cve_2018_14847909★ · 2022-11-29
- Acengerz/WinboxPoC0★ · 2020-02-20
- AsrafulDev/winboxbug0★ · 2021-08-31
- Djay-ui/Mikrotik-router-hack1★ · 2024-10-23
- ElAcengerz/WinboxPoC1★ · 2020-02-28
- Jie-Geng/PoC2★ · 2019-09-19
- MRZyNoX/Wifi-Hack0★ · 2020-03-03
- Octha-DroiidXz/Cracker-Winbox0★ · 2020-07-21
- PuguhDy/0-day-exploit-Mikrotik1★ · 2024-04-04
- RainardHuman/WinBox_Exploit0★ · 2020-11-19
- Ratlesv/LadonGo1★ · 2023-06-20
- Tr33-He11/winboxPOC1★ · 2019-02-18
- ahmadyusuf23/Mikrotik-Exploit1★ · 2020-07-16
- alamsyahh15/PocWinbox0★ · 2020-10-01
- babyshen/routeros-CVE-2018-14847-bytheway4★ · 2022-11-17
- developershakil260/winboxbug0★ · 2021-08-31
- eckoxxx/ecko0★ · 2019-07-12
- etc-i/Y0★ · 2019-11-28
- exploit747/WinboxPoc0★ · 2020-04-22
- ferib/WinboxExploit1★ · 2019-10-30
- firmanandriansyah/WinboxExploitMikrotik13★ · 2018-12-30
- jas502n/CVE-2018-1484730★ · 2018-12-16
- johnoseni1/Router-hacker-Exploit-and-extract-user-and-password-38★ · 2021-11-11
- jphasibuan23/Tes1★ · 2023-11-14
- k8gege/LadonGo1717★ · 2023-12-15
- mahmoodsabir/mikrotik-beast6★ · 2019-05-26
- mrmtwoj/0day-mikrotik119★ · 2024-09-29
- nomiyousafzai/mnk2★ · 2018-12-02
- notfound-git/WinboxPoC0★ · 2020-12-26
- ridwan-aplikom/hackwifi0★ · 2019-01-26
- sinichi449/Python-MikrotikLoginExploit21★ · 2019-09-30
- spot-summers/winbox0★ · 2020-05-13
- syrex1013/MikroRoot15★ · 2025-06-12
- tausifzaman/CVE-2018-148471★ · 2025-04-16
- vickysanthosh/routersploit0★ · 2019-11-29
- whiterabb17/MkCheck12★ · 2023-04-17
- yukar1z0e/CVE-2018-148471★ · 2020-05-18
- mourafuseti/VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS1★ · 2026-05-20
- luel-4013/misfortune-cookie0★ · 2026-09-07
- TheMalwareGuardian/CVE-2018-14847/blob/bd67180037189c9e217a8568237486162b8b3743/Exploit/E…0★ · 2026-04-29