CVE-2018-7445
CriticalExploitedPublic exploitA buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.
Published Mar 19, 2018 · Updated Nov 7, 2025
Key Facts
Patch immediately- CVE-2018-7445 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Routeros (Mikrotik).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 1, 2020. Public exploit code is available.
- EPSS estimates a 61% probability of exploitation in the next 30 days.
- Fixed versions are available, including Routeros 6.41.3.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
61%
Higher than 99.1% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2018-7445 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| Industry KEV feed | Dec 1, 2020 | Sep 29, 2022 | Not reported |
| CIRCL KEV | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| ENISA EUVD | Sep 8, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
13 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| RouterosMikrotik | 6.42-rc11, 6.42-rc12, 6.42-rc14, 6.42-rc15, 6.42-rc18, 6.42-rc2, 6.42-rc20, 6.42-rc23 | 6.41.3 |
Patched Releases
Routeros
6.41.3
Timeline
Publicly disclosed
Mar 19, 2018
Added to Industry KEV feed
Dec 1, 2020
Added to CISA KEV
Sep 8, 2022
Added to CIRCL KEV
Sep 8, 2022
Added to ENISA EUVD
Sep 8, 2022
Last updated
Nov 7, 2025
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- advisory103427
- exploit20180315 [CORE-2018-0003] MikroTik RouterOS SMB Buffer Overflow
- exploitVulnCheck exploitation report
- exploithttps://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow
- exploitExploitDB-44290
FAQ
Common Questions.
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.
Affected: Routeros (Mikrotik) versions 6.42-rc11, 6.42-rc12, 6.42-rc14, 6.42-rc15, 6.42-rc18, 6.42-rc2, 6.42-rc20, 6.42-rc23. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 1, 2020.
Yes. It was added on Sep 8, 2022 with a federal remediation due date of Sep 29, 2022.
Public exploit code is available.
Fixed versions are available, including Routeros 6.41.3.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2018-7445 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo