CVE-2018-7445 is a stack-based buffer overflow vulnerability in MikroTik RouterOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 8 September 2022, which means attackers have used it in real attacks. In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages.
What a stack-based buffer overflow means in a router
A stack-based buffer overflow in network firmware means packet parsing logic writes beyond a fixed-size stack buffer. In RouterOS, that matters because malformed traffic can turn a normal protocol parser into a crash path, memory corruption path, or code execution path.
Router operating systems are especially sensitive to parser flaws because they sit close to the network edge and often process attacker-controlled input before any higher-level filtering can help. When the affected code handles NetBIOS session request messages, the weakness is not just theoretical, it is tied to a real network-exposed parsing routine.
Why CVE-2018-7445 is dangerous in RouterOS
This class of bug is dangerous because stack corruption can affect control flow and process stability in one step. In embedded and infrastructure software, that can mean denial of service, unexpected device reboot, or a foothold into a privileged management plane if exploitation succeeds.
The fact that CISA added this CVE to the Known Exploited Vulnerabilities catalogue means organisations should treat it as an active exposure, not a background software defect. For vulnerability context and record verification, CVE Program and NIST National Vulnerability Database are the authoritative sources for the identifier and record history.
How organisations determine exposure and confirm whether they are affected
Exposure checks start with asset inventory, because a vulnerability only matters if MikroTik RouterOS is actually present. Organisations should identify all RouterOS devices, determine where they sit in the network, and confirm whether any are reachable from untrusted networks or exposed through administrative services and legacy segmentation gaps.
Because the trigger is a packet-processing flaw, perimeter placement and service exposure matter as much as software presence. If a device can receive NetBIOS-related traffic from networks it should not trust, the organisation should assume the attack surface exists until proven otherwise. Vendor advisory review and CISA KEV status should be part of that exposure check, not a substitute for it.
Remediation, detection, and post-patch review
Remediation should prioritise vendor guidance and the patch information referenced by the vendor and KEV catalogue, rather than relying on generic vulnerability scoring alone. If immediate patching is not possible, compensating controls should reduce reachability, restrict ingress to the affected parser path, and narrow which hosts can contact the device at all.
Detection should look for abnormal router behaviour, unexpected crashes, restarts, management-plane instability, and signs that the device was touched before the patch. After remediation, review logs and configuration state for changes that could indicate exploitation, because a parser overflow can be an entry point rather than the end of the incident.
Risk and Threat Considerations
This vulnerability matters most when the router is externally reachable or sits on a segmented network that still accepts hostile traffic. A stack-based buffer overflow in a protocol parser can give an attacker an entry path into a high-value network device, especially if exposure is broad or the device is slow to patch.
Failure mechanism: A crafted NetBIOS session request can trigger memory corruption while RouterOS processes the message, potentially leading to process failure or attacker-controlled execution.
Impact: The likely consequences are denial of service, loss of router integrity, and possible follow-on access into adjacent network paths or management functions if the device is successfully compromised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | CVE-2018-7445 is an actively exploited RouterOS flaw requiring prioritised vulnerability handling. |
| Recommendation — Prioritise, patch, and verify exposed RouterOS devices before lower-risk findings. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Router compromise signs are detected through monitoring for crashes, reboots, and unusual device behaviour. |
| Recommendation — Monitor RouterOS devices for anomalous restarts, failures, and unexpected management-plane activity. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The vulnerability requires prompt remediation and verification on affected network devices. |
| SC-7 — Boundary Protection | Exposure depends on whether untrusted traffic can reach the vulnerable parser on network-facing devices. | |
| Recommendation — Remediate the RouterOS flaw promptly and verify the fix on every exposed device. Restrict inbound reachability to RouterOS devices and reduce exposure to untrusted network traffic. | ||
| OWASP ASVS | V13 — Configuration | The issue highlights unsafe deployment and exposure conditions around a network service parser. |
| Recommendation — Harden device configuration to minimise unnecessary parser exposure and attack surface. | ||
Practitioner Guidance
Why practitioners should care: Treat edge routers as security-critical assets, not routine appliances, because a single parser flaw can affect availability and trust at the network boundary. If a RouterOS system is internet-facing or handles untrusted traffic, prioritise it ahead of lower-exposure endpoints.
What to watch for: Focus on devices that are hard to inventory, rarely updated, or used as transit points for multiple segments. Those are the systems where a memory-corruption flaw can persist longest and create the widest blast radius.
Practitioner takeaway: Use the vendor advisory and CISA KEV entry to drive your patch decision, then validate that exposure has actually been reduced rather than assuming the update alone closed the risk.