A Winbox flaw let attackers download the router's user database. Years later, unpatched routers were still being hijacked for cryptomining and botnets.
Publicly disclosed: 23 April 2018
In April 2018 MikroTik released RouterOS updates for a vulnerability in the Winbox management service. A specially crafted request let an attacker read files from the router without logging in — including the user database, from which administrator passwords could be recovered. Hundreds of thousands of routers with Winbox open to the internet were then hijacked: traffic was redirected, cryptomining scripts were injected into web pages and routers were added to botnets.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2018-14847 | Critical (directory traversal, credential theft) | RouterOS up to 6.42 (current) and 6.40.7 (bugfix) | 6.42.1, 6.40.8 and later |
Many routers were never updated, and others were updated without changing passwords — so attackers kept access. The same pattern repeated with the RouterOS SSH and WebFig flaws of 2026.
An update closes the hole. Only a password change closes the door the attacker already used.
Sources: MikroTik blog, NVD CVE-2018-14847.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
