CVE-2018-14847

MikroTik RouterOS 6.42 allows unauthenticated remote attackers to read arbitrary files and authenticated attackers to write arbitrary files via directory traversal in the WinBox interface.

This directory traversal flaw in MikroTik RouterOS exposes sensitive data and enables file manipulation, directly impacting DIB networks reliant on network infrastructure. The vulnerability is actively exploited (KEV catalog), meaning organizations must patch immediately to prevent data exfiltration and unauthorized system changes. DIB compliance requires continuous monitoring and rapid patching of such known, exploited flaws to avoid FCA settlements and maintain security posture.

Shame score — A directory traversal vulnerability in widely deployed router firmware that allows unauthenticated file reads and authenticated file writes, and is actively exploited in the wild, represents a severe, avoidable failure in securing critical network infrastructure.