Loading story…
MBSD-SOC reported a renewed rise in attack traffic targeting MikroTik RouterOS devices vulnerable to CVE-2018-14847, a WinBox directory traversal flaw affecting versions 6.42 and earlier. The vulnerability allows unauthenticated attackers to read arbitrary files and authenticated attackers to write arbitrary files, and observed activity in August appeared aimed at retrieving the router user database through path traversal. MBSD-SOC said detections had previously spiked in April and May 2022, later declined, and then increased again from mid-August.
The campaign largely originated from Germany, which accounted for 99.7% of observed detections, while Japan represented 0.3%. Public exploit and proof-of-concept details for CVE-2018-14847 have long been available, increasing the risk to organizations still running unpatched RouterOS systems. Defenders were urged to update affected devices to the latest RouterOS release, while also noting the separate severe RouterOS issue CVE-2023-30799 disclosed later.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2018-14847 was updated and continued to reference multiple public exploit and proof-of-concept resources.
MBSD-SOC detected another increase in attacks targeting CVE-2018-14847 in mid-August 2023. The observed traffic appeared to attempt path traversal to retrieve the RouterOS user database, including requests for "/flash/rw/store/user.dat".
The MBSD-SOC article noted that a separate severe MikroTik RouterOS vulnerability, CVE-2023-30799, was reported in July 2023.
MBSD-SOC reported that attacks targeting MikroTik RouterOS vulnerability CVE-2018-14847 increased from April to May 2022 before later subsiding.
The CVE record for CVE-2018-14847 was published, documenting a directory traversal flaw in the WinBox interface of MikroTik RouterOS through version 6.42 that allows unauthenticated file reads and authenticated file writes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Active exploitation of the **MikroTrick** vulnerability chain is allowing attackers to take over internet-exposed MikroTik RouterOS devices without credentials. The attack combines an SSH rekeying authentication-state bypass—reported as `CVE-2026-67279` (though one advisory lists `CVE-2026-67277`)—with `CVE-2026-86060`, in which a crafted username can make the RouterOS login helper accept an attacker-controlled privileged identity. Researchers reproduced full administrative compromise on vulnerable RouterOS 7.x systems, enabling access-control bypass, persistence, and potential lateral movement into connected networks; CISA has added the flaws to its Known Exploited Vulnerabilities catalog. MikroTik has issued fixes in RouterOS `6.49.21`, `7.23.4`, `7.24.2`, and subsequent applicable releases. Organizations should immediately patch exposed routers, restrict external exposure of Winbox and API services, and audit administrator accounts. They should also investigate devices for attacker-created privileged accounts, scripts, and scheduled tasks, because patching alone will not remove persistence or rotate credentials that may have been exposed during compromise.
Sep 17, 2026
MikroTik patched six vulnerabilities in RouterOS releases earlier than `6.49.21`, `7.23.4`, and `7.24.2`. CERT Polska reported flaws affecting SSH authentication and RSA signature validation, WebFig file access, the `btest` service, and SSH login privilege handling. The issues can permit unauthenticated remote SSH command execution, disclosure of root-owned files that may contain credentials, kernel restarts, privilege escalation, and TLS server impersonation. Organizations running affected RouterOS branches should upgrade immediately to RouterOS `6.49.21` (Long-term), `7.23.4` (Long-term), or `7.24.2` (Stable). Administrators should review RouterOS flagged status and logs for compromise evidence, and investigate unauthorized accounts, scripts, scheduled tasks, firewall, VPN, DNS, NAT, and other configuration changes, particularly on internet-exposed devices.
Sep 11, 2026
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **FH451 `1.0.0.9`** and **FH1201 `1.2.0.14(408)`**. The flaws, tracked as **`CVE-2026-4535`** and **`CVE-2026-5045`**, are stack-based buffer overflows in the `WrlclientSet` function exposed through the `/goform/WrlclientSet` endpoint. In both cases, an attacker can trigger the issue by manipulating the `GO` argument, creating a remotely reachable attack path against the devices' web management interface. Both CVEs are classified under **`CWE-119`** and **`CWE-121`**, and published scoring indicates high impact to **confidentiality, integrity, and availability**, with some vectors rating the flaws at critical severity. Public exploit information is already available for both issues, raising the risk of real-world exploitation against unpatched internet-exposed routers and embedded deployments using the affected firmware.
Jun 29, 2026