CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer Overflow

Exploited in the wild Critical 9.8 Published 19 Mar 2018 Updated 21 Oct 2025

Remote unauthenticated attackers can execute arbitrary code via a buffer overflow in the SMB service of MikroTik RouterOS devices.

Exploited in the wild: Since 8 Sep 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-7445?

CVE-2018-7445 is a critical memory corruption vulnerability in Mikrotik Routeros, published on 19 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.

Weakness: CWE-119

Which versions are affected by CVE-2018-7445?

It affects 1 product.

Products include Mikrotik Routeros.

How do I fix CVE-2018-7445?

No fix has been published for CVE-2018-7445 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 29 Sep 2022.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-7445 being exploited?

Yes. Attackers have exploited CVE-2018-7445 in the wild since at least 8 Sep 2022.

Public exploit code: 1 Exploit-DB entry.

All Mikrotik Routeros vulnerabilities

Sources

Also known as GHSA-v596-x9hf-63gj.