CVE-2018-7445

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 60,8%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada mikrotik routeros. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 8 September 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.

Rincian

Terbit di NVD

19 Maret 2018

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

60,8% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability

Masuk KEV

8 September 2022

Tenggat CISA

29 September 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7445 pemerintah AS
• http://seclists.org/fulldisclosure/2018/Mar/38 exploit · mailing list · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/103427 advisory pihak ketiga · vdb entry
• https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/44290/ exploit · advisory pihak ketiga · vdb entry