Critical Directory Traversal in MikroTik RouterOS (CVE‑2018‑14847) Enables File Read/Write
What It Is – MikroTik RouterOS ≤ 6.42 contains a directory‑traversal flaw in the WinBox management interface that allows an unauthenticated remote attacker to read arbitrary files and an authenticated attacker to write arbitrary files.
Exploitability – Publicly disclosed; proof‑of‑concept code exists; CVSS v3.1 base score 9.8 (Critical).
Affected Products – MikroTik RouterOS versions 6.42 and earlier (all hardware that runs RouterOS, e.g., CCR, hAP, RB series).
Why It Matters for Trust & Control Assurance
- Access‑control integrity – The flaw bypasses file‑system protections, exposing a gap in the “prevent unauthorized read/write” control objective that underpins many frameworks (e.g., NIST CSF Identify & Protect).
- Continuous evidence – Demonstrating that routers are patched and that file‑access logs are retained provides audit‑ready evidence of due‑diligence.
- Supply‑chain confidence – Network‑infrastructure components are often a third‑party risk; proving they meet the same control standards as internal assets is a key trust signal for enterprise buyers.
Recommended Actions
- Patch immediately – Upgrade all MikroTik RouterOS devices to version 6.43 or later, which resolves CVE‑2018‑14847.
- Validate integrity – Scan the file system on each router for unexpected or newly created files; remove any malicious artifacts.
- Enable and centralize logging – Configure WinBox and system logs to capture file‑access events and forward them to a SIEM for continuous monitoring.
- Inventory & harden – Maintain an up‑to‑date inventory of all RouterOS instances, disable unnecessary services, and enforce strong, unique admin credentials.
- Document controls – Record the remediation steps and log‑retention policies as evidence for audit or third‑party assessments.
Source: CISA KEV – CVE‑2018‑14847