CVE-2018-14847 is a router OS directory traversal vulnerability in MikroTik RouterOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 1 December 2021, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means in practice
A directory traversal flaw means an attacker can manipulate path handling to reach files or functions outside the intended directory boundary. In a router operating system, that can expose management data, configuration material, or other system resources that were never meant to be reachable from the request path.
The danger is not just file disclosure. On network infrastructure, traversal bugs can become a stepping stone to broader compromise if the router stores credentials, configuration backups, session material, or other sensitive operational state in locations that the attacker can read or influence.
Why routers are especially sensitive targets
RouterOS sits close to the trust boundary of the network, so a weakness there affects more than one host. If an attacker reaches the management plane, they may be able to learn internal topology, disrupt traffic, or use the device as a pivot point into adjacent systems. For broader context on how traversal and related web-facing flaws are commonly abused, see Web Application Attacks Guide.
Because this CVE was added to CISA’s Known Exploited Vulnerabilities catalogue, the practical assumption is that real-world exploitation has already occurred. That makes exposure more urgent than a purely theoretical bug, especially on edge devices that are internet-facing or lightly monitored.
How organisations assess exposure and validate remediation
Start with an accurate inventory of every MikroTik RouterOS instance, then determine which devices are internet-exposed, remotely managed, or embedded in critical paths. That inventory should be checked against vendor advisories and the KEV listing so the team can confirm whether a device is still exposed and whether the applicable fix or mitigation has been applied.
For prioritisation and verification discipline, the best next reference point is Vulnerability Management Guide, which covers asset scope, KEV-based prioritisation, exceptions, and remediation validation. For authoritative record lookup, use the NIST National Vulnerability Database alongside the CVE Program record.
If patching is delayed, organisations should reduce exposure by removing unnecessary management reachability, tightening administrative access, and isolating the device from direct internet access wherever possible. Those compensating controls do not replace the fix, but they can narrow the attack surface while remediation is in progress.
Detection, containment, and post-exploitation review
After a router flaw is disclosed, defenders should not stop at patching. They should review logs, configuration changes, unexpected management sessions, and signs that the device was used as an access bridge or persistence point. Network infrastructure compromises often leave subtle evidence, so the review should include traffic anomalies and any unexplained changes to routing, services, or administration settings.
If exploitation is suspected, treat the device as a potential source of credential and session exposure as well as configuration tampering. That means checking whether administrative secrets, VPN material, or other access dependencies were accessible through the affected system, and whether additional credentials need rotation after containment.
Risk and Threat Considerations
Directory traversal on a network appliance can expose management data, configuration files, or stored secrets, which makes the flaw materially more dangerous than a generic web bug. On edge devices, compromise can support reconnaissance, persistence, traffic manipulation, and lateral movement into the wider environment.
Failure mechanism: The attacker abuses path normalisation or file handling weaknesses to escape the intended directory scope and reach resources the router should not disclose or process.
Impact: Exposure of sensitive configuration or credentials can lead to administrative takeover, traffic interception, service disruption, and follow-on compromise of connected systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Asset Inventory | Accurate asset inventory is required to find exposed RouterOS systems. |
| PR.AA-01 — Identities and Credentials | Router compromise can expose credentials and management access paths. | |
| DE.CM-01 — Networks and Network Services Monitored | Network monitoring helps spot exploitation or unusual router activity. | |
| Recommendation — Inventory every RouterOS device and map it to remediation status. Review and rotate credentials that may have been exposed through the device. Monitor router traffic and management-plane activity for suspicious changes. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE requires active vulnerability identification and exposure tracking. |
| CM-8 — System Component Inventory | Finding affected routers depends on a complete component inventory. | |
| SI-2 — Flaw Remediation | The vulnerability must be fixed or mitigated as a remediation priority. | |
| Recommendation — Scan RouterOS assets and verify remediation against current advisories. Maintain a complete inventory of RouterOS devices and their exposure state. Apply the vendor fix or compensating mitigation without delay. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Continuous vulnerability management is the core control for a known exploited CVE. |
| CIS-12 — Network Infrastructure Management | Router security depends on hardening and controlling network infrastructure exposure. | |
| Recommendation — Prioritise this KEV-listed flaw for rapid identification and remediation. Restrict management access and harden the affected router environment. | ||
| OWASP ASVS | V13 — Configuration | Traversal exploits often arise from weak path and deployment configuration. |
| V16 — Security Logging and Error Handling | Detection of exploitation depends on logging and safe error handling. | |
| Recommendation — Validate routing and path-handling configurations that influence file access. Ensure logging captures suspicious traversal and administration activity. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org