Critical 9.8Known exploited (CISA KEV)Published Mar 19, 2018

CVE-2018-7445A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.

Updated under an hour ago (2026-10-19 05:50 UTC)

Does this affect you?

It affects mikrotik routeros. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Sep 8, 2022; federal agencies had to remediate by Sep 29, 2022. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for mikrotik routeros

Exploited in the last 30 days

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-119
Known exploited: Added to CISA KEV Sep 8, 2022; federal remediation due Sep 29, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 60.81% (percentile 99)
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

mikrotik routeros mikrotik:routeros	before 6.41.3; 6.42; 6.42; 6.42; 6.42; 6.42; 6.42; 6.42; and 5 more ranges	NVD

References

http://www.securityfocus.com/bid/103427vdb-entry, x-refsource-bid, third-party-advisory
http://seclists.org/fulldisclosure/2018/Mar/38mailing-list, x-refsource-fulldisc, exploit, third-party-advisory, vdb-entry
https://www.exploit-db.com/exploits/44290/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflowx-refsource-misc, exploit, third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7445us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.