CVE-2018-7445

This vulnerability is like a “trapdoor” in the router’s network file-sharing feature: if someone sends specially made messages, it can crash and potentially hand control of the router to the attacker. If that happens, the attacker may be able to run their own code on your router, which can then affect the safety and reliability of your whole network.

This matters if you run MikroTik RouterOS on a device that has the SMB service enabled and reachable over the network. It is especially urgent if the SMB service can be reached by attackers without authentication (for example, from the internet or from any network you don’t fully trust). The risk applies when the vulnerable RouterOS version is in use and the SMB service is reachable over the network.

This is being actively treated as a real-world problem: CVE-2018-7445 is listed in the CISA KEV and has public exploits available. Attackers can exploit it remotely without authentication by sending crafted NetBIOS session request messages to the SMB service, and the traffic-light verdict for this CVE is RED. Treat this as an emergency patch priority.

1. Identify affected devices

   • On each MikroTik RouterOS device, note the exact RouterOS version.
   • Determine whether the SMB service (SMB/NetBIOS handling) is enabled and listening.
   • Confirm whether that service is reachable from untrusted networks (internet-facing) or any network segment that could be accessed by an attacker.

2. Confirm exposure likelihood

   • Vulnerability can be triggered by sending specially crafted NetBIOS session request messages over the network.
   • Because exploitation is unauthenticated and no user interaction is required, focus on whether the SMB service is exposed/reachable.

3. Apply the fixed software

   • Upgrade RouterOS to a version that includes the fix: fixed in 6.41.3.
   • Upgrade target: 6.41.3 or later.
   • Follow MikroTik’s upgrade instructions for your hardware and deployment method.

4. Emergency mitigation while patching (if you must delay upgrade)

   • Immediately restrict network access to the SMB service so it is not reachable from untrusted networks.
   • After mitigation is in place, schedule the RouterOS upgrade to the fixed version as soon as possible.

5. KEV / timing

   • CISA KEV remediation due date for this issue was 2022-09-29.
   • If you have not already remediated, treat this as overdue.

6. What to monitor after changes

   • After upgrade/mitigation, monitor for continued probing of SMB/NetBIOS-related traffic and validate that the SMB service is either secured or no longer exposed.
   • Check that the device remains stable and that the SMB service behaves as expected (or confirm it is disabled if not required).

Severity is critical and the reported CVSS indicates a very high-risk issue. The weakness is a classic memory-safety flaw (CWE-119, buffer overflow) in MikroTik RouterOS’ SMB service when handling NetBIOS session request messages. The key mechanism is that the overflow occurs before authentication, enabling an unauthenticated remote attacker to achieve code execution by sending crafted network packets to the reachable SMB service.

Exploitation status: CVE-2018-7445 is listed in the CISA KEV (confirmed real-world remediation expectation) and there is public exploit availability (multiple known exploits), which increases practical risk. Public exploit/KEV status outweighs mere prediction.

Fix: RouterOS is fixed in 6.41.3. Devices on earlier versions are described as vulnerable in the findings/backstop.