CVE-2018-7445

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 61%
Percentil entre todas las CVEs puntuadas: 99
Fecha de la puntuación: 1/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 8/9/2022
Plazo de remediación: 29/9/2022
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %

Buffer overflow en servicio SMB remoto sin autenticación (AV:N, PR:N) permite ejecución de código arbitrario en RouterOS. KEV confirmado con explotación activa.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Vulnerability Scanning Restrict Web-Based Content Network Segmentation Limit Software Installation Limit Access to Resource Over Network

Tecnologías afectadas (1)

Mikrotik — Routeros

CWE

CWE-119
CWE-119

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2018-7445",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2018-7445",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-07T16:27:32.357265Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-19T21:29:01.083",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2018/Mar/38",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/103427",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/44290/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2018/Mar/38",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/103427",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/44290/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7445",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado un desbordamiento de búfer en el servicio MikroTik RouterOS SMB al procesar mensajes de petición de sesión NetBIOS. Los atacantes remotos con acceso al servicio pueden explotar esta vulnerabilidad y ejecutar código en el sistema. El desbordamiento ocurre antes de que tenga lugar la autenticación, por lo que es posible para un atacante remoto no autenticado explotarlo. Todas las arquitecturas y dispositivos que ejecutan RouterOS en versiones anteriores a la 6.41.3/6.42rc27 son vulnerables."
    }
  ],
  "lastModified": "2026-06-17T02:03:08.460",
  "cisaActionDue": "2022-09-29",
  "cisaExploitAdd": "2022-09-08",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE5AFDA3-472A-4FAC-A92C-F3836E71603F",
              "versionEndExcluding": "6.41.3"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAD82B9F-CAA4-431A-BF43-838D3AF73BB9"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A8EB79F-4E23-4B48-A1A1-7626AB46EFDD"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD197A47-235B-48A7-9FA9-84FB67C609AC"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37225B39-D5B1-41DF-9C2F-A3849E5F41AF"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc18:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "080A4898-A296-4950-A4F9-559F8E30A6C1"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EEB8E89F-C85F-4193-954D-4B490F93D649"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "449AAA12-1124-4C9B-8C42-F564E85F9196"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38DBFC19-271E-4687-901C-9488155BB4B6"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc24:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EC55745-ABB4-4B6E-B158-5BD642DB6D15"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63E57994-8BF2-4322-A7CE-D5D89F989FE3"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5DFE39F-F4D6-4C89-A4C9-7C6BB2F8DAA7"
            },
            {
              "criteria": "cpe:2.3:o:mikrotik:routeros:6.42:rc9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62A59F9E-6C26-497D-B4C1-CFE14D01F79A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability"
}