CVE-2018-10070

Imagine your router as a doorman that normally handles a steady flow of visitors. With this bug, someone can send a weird “FTP message” that makes the doorman work nonstop until the building’s resources run out, and then the router reboots. For a small business, that can mean losing internet or internal connectivity until it comes back.

This matters if you use MikroTik router firmware version 6.41.4 and your router’s FTP service on port 21 is reachable from the internet. Because the issue is unauthenticated, you don’t need logins for an attacker to try it. The real risk is when attackers can reach port 21 (for example, if FTP is exposed to the public internet).

This should be treated as a priority because there is a public exploit available and the attack can directly exhaust CPU and RAM without any authentication. While the vendor-specific fix details weren’t found in the available information, the impact (service disruption and reboots) is immediate when triggered. Given the traffic-light verdict is AMBER, act now on exposure reduction and confirm an upgrade/mitigation path with your vendor.

1. Confirm exposure scope

   • Identify every MikroTik router running firmware version 6.41.4.
   • Verify whether FTP on port 21 is reachable from the internet (for example, by checking your public firewall/NAT rules, or having your IT team test from an external network).

2. Confirm signs of attempted exploitation (if you can)

   • Check router logs for indicators such as “router was rebooted without proper shutdown”.
   • Watch for patterns of very high CPU and memory pressure around the time of connection attempts, and for repeated unplanned reboots.

3. Immediate mitigation if exposed and on 6.41.4

   • Restrict access to port 21 to only trusted admin IP addresses (your office IPs / VPN IPs).
   • If you do not require FTP, disable the FTP service on the router.
   • Ensure that any public access rules/firewall rules do not allow inbound FTP from the internet.

4. Remediation via patch/upgrade

   • The available information does not provide a fixed version. Contact MikroTik support or check MikroTik’s official security advisories/firmware release notes specifically for CVE-2018-10070 to obtain the correct fixed firmware and upgrade instructions for your exact model.
   • Plan a controlled upgrade: back up the router configuration first, schedule downtime if needed, and validate that WAN/internet services and essential internal routing still work after the upgrade.

5. Temporary workaround if upgrading is delayed

   • Keep FTP locked down (only trusted sources) or fully disabled.
   • Add/confirm firewall rules to prevent inbound access to port 21 from untrusted networks.
   • Continue monitoring CPU/memory and reboot logs until the router is upgraded or FTP is no longer reachable.

6. What to monitor after changes

   • Router uptime and reboot counts.
   • Logs for unexpected connection attempts to FTP/port 21.
   • Ongoing CPU/RAM usage to ensure the router is stable.

Severity is high in impact terms because the weakness is resource exhaustion (CWE-400): an unauthenticated remote attacker can send a crafted FTP request that begins with many null characters, driving CPU and RAM usage to exhaustion so the router stops accepting new FTP connections and then reboots after about 10 minutes. No entry is listed in CISA KEV for this CVE in the provided findings. Exploitation maturity: public exploit code is available (not yet tied to KEV in the findings). Predicted likelihood exists (EPSS was provided as a prediction with a falling trend), but public blocks should not rely on it over confirmed exploitation; in this set, KEV/news confirmation is not present, so urgency is grounded in the availability of public exploits and the direct service disruption described. The attacker path does not require credentials (no authentication required) and targets FTP on port 21 (which increases risk when FTP is publicly reachable).