Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2018-7445

CVE-2018-7445CRITICAL

n/a n/a — MikroTik RouterOS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .6081   99.1   YES

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Feb 23  Reserved by mitre
  Mar 19  Published (CNA: mitre)
  Sep 8   Added to CISA KEV, remediation due 2022-09-29

CWE-119 · CNA: mitre · CVSS v3.1 · 5 references · KEV due September 29, 2022

Description

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
February 23, 2018	Reserved	Reserved by mitre
March 19, 2018	Published	Published (CNA: mitre)
September 8, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-09-29

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	n/a	—	n/a	—

Weaknesses

CWE-119

References (5)

http://seclists.org/fulldisclosure/2018/Mar/38 [mailing-list, x_refsource_FULLDISC]
http://www.securityfocus.com/bid/103427 [vdb-entry, x_refsource_BID]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7445 [government-resource]
https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow [x_refsource_MISC]
https://www.exploit-db.com/exploits/44290/ [exploit, x_refsource_EXPLOIT-DB]

Authoritative record: CVE-2018-7445 at cve.org

Weaknesses: CWE-119

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2018-7445 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.