CVE-2018-14847

WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. Blogpost https://n0p.me/winbox-bug-dissection/ Requirements Python 3+ This script will NOT run with Python 2.x or lower. How To Use The script...

CVE-2024-54772

CVE-2024-54772 MikroTik-RouterOS Username Enum This repo contains the exploit for CVE-2024-54772 which can enumerate valid usernames using a wordlist in Mikrotik routers running RouterOS stable versions v6.43 through v7.17.2. The patch is available in v6.49.18 and v7.18. For long-term release,...

MikrotikExploit

Mikrotik Exploit Scan and Export RouterOS Password allow you to scan subnet of IPv4 in loop with different port. Installation install python3 Ubuntu/Debian: root@kitploit: $ apt-get install python3 install python3 Python package manager Ubuntu/Debian: root@kitploit: $ apt-get install python3-pip...

winboxPOC

WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. Requirements Python 3+ This script will NOT run with Python 2.x or lower. How To Use The script is simple used with simple arguments in the...

routeros-CVE-2018-14847-bytheway

By the Way By the Way is an exploit that enables a root shell on Mikrotik devices running RouterOS versions: Longterm: 6.30.1 - 6.40.7 Stable: 6.29 - 6.42.0 Beta: 6.29rc1 - 6.43rc3 The exploit leverages the path traversal vulnerability CVE-2018-14847 to extract the admin password and create an...

CVE-2020-11881

CVE-2020-11881 MikroTik SMB Remote Denial of Service DoS This report describes CVE-2020-11881, an unauthenticated remote DoS for MikroTik's SMB service running on RouterOs. The vulnerability allows an attacker to crash the running SMB service and was responsible disclosed to securitymikrotik.com ...

CVE-2024-27686

MikroTik RouterOS Denial of Service Vulnerability 📌 Description This document describes a Denial of Service DoS vulnerability found in certain versions of MikroTik RouterOS. The vulnerability is due to insufficient handling of crafted SMB requests. A remote attacker could exploit this issue by...

Mikrotik-router-hack

WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. The vulnerability has long since been fixed, so this project has ended and will not be supported or updated anymore. You can fork it and updat...

Python-MikrotikLoginExploit

Mikrotik 登录漏洞利用 CVE-2018-14847 的 Mikrotik 漏洞概念验证（PoC）（主要针对 Winbox），工作原理是直接从 RouterOS 的默认端口 8291 读取密码。 Original by: https://github.com/BigNerd95/ 依赖要求 Python 3+ 在 Linux 上安装 root@kitploit: apt install python3 使用示例 WinBox（TCP/IP） root@kitploit: python3 WinboxExploit.py 端口 例如： root@kitploit: $ python...

CVE-2018-14847-EXPLOIT

CVE-2018-14847 - MikroTik WinBox 文件读取 💥 MikroTik RouterOS 至 6.42 版本受 WinBox 接口中的目录遍历漏洞影响，允许未经身份验证的远程攻击者读取任意文件，并允许经过身份验证的远程攻击者写入任意文件。此漏洞编号为 CVE-2018-14847，对受影响的系统构成重大安全风险。该漏洞源于 WinBox 接口对输入验证不当，使攻击者能够导航至 WinBox 沙箱之外的目录。通过利用此漏洞，攻击者可以读取敏感的系统文件，例如配置文件、用户名、密码，甚至可以向系统写入任意文件，从而可能导致进一步入侵。 免责声明 ⚠️ 本仓库包含...

CVE-2025-6563

MikroTik 热点登录页面反射型 XSS 漏洞通告 概述 在 MikroTik RouterOS 热点登录页面中发现了一个反射型跨站脚本（XSS）漏洞。该漏洞通过 dst URL 参数触发，该参数对输入进行了不当过滤，从而允许恶意 JavaScript 代码在受害者的浏览器中执行。 受影响产品 MikroTik RouterOS 热点登录页面 低于 7.20 的版本 漏洞详情 当攻击者构造类似以下 URL 时触发漏洞： http://target-ip/login?dst=javascript:alert3 当用户访问此 URL 时，响应中会反射出...

pocs_slides

分享我在 IoT / 协议安全方面的安全公告、PoC、幻灯片和脚本。你可以通过以下方式找到我： Medium: https://medium.com/@cq674350529 博客: https://cq674350529.github.io/ 邮箱: [email protected] Twitter: @cq674350529 幻灯片 OffByOne2025: 补丁比对，你是我的剑！深入剖析 FortiGate 中两个关键的 N-day 漏洞 视频 BHEU2023: 打破理论极限：虚拟网卡与物理网卡之间的差距 合作 BHEU2022:...

CVE-2018-14847

🐞 MikroTik CVE-2018-14847 Unauthenticated path traversal in MikroTik's Winbox protocol leaking admin credentials from /flash/rw/store/user.dat 📑 Table of Contents Overview Affected Versions Vulnerability 📂 Winbox Protocol Path Traversal Password Decryption Developer Backdoor Exploit References 📋...

cve-2026-86060

CVE-2026-86060 — MikroTik RouterOS SSH 认证前权限提升至完全管理控制 字段| 值 ---|--- CVE| CVE-2026-86060 产品| MikroTik RouterOS（SSH 服务） 受影响版本| RouterOS 6.x 及 7.0.0 – 7.23.3（含） 修复版本| RouterOS 7.23.4 及更高版本 漏洞类型| 认证前权限提升（认证绕过 / 访问控制失效） 攻击向量| 远程、未认证、通过 SSH 服务 前置条件| 无 — 无需凭据、无需用户交互、无需本地访问 影响| 路由器的完全管理（策略）控制 CVSSv3.1|...

MikroTik-RouterOS-6.49.18-Exploit-Kit

MikroTik-RouterOS-6.49.18-Exploit-Kit 📋 Project Summary of MikroTik RouterOS 6.49.18 Exploit Kit 🎯 Overview A professional and comprehensive project was created to exploit MikroTik RouterOS 6.49.18 devices, including all required components with a complete Arabic interface and detailed...

The vulnerability in the WebFig web interface of the MikroTik RouterOS operating system allows a hacker to increase their privileges and gain unauthorized access to protected information.

The vulnerability in the WebFig web interface of the MikroTik RouterOS operating system is related to the use of an uninitialized pointer. Exploiting this vulnerability can allow a malicious actor to increase their privileges and gain unauthorized access to protected information...

The vulnerability of the MikroTik RouterOS operating system, related to errors in verifying the cryptographic signature, allows a hacker to replace the TLS server.

The vulnerability of the MikroTik RouterOS operating system is related to errors in verifying the cryptographic signature. Exploiting this vulnerability allows a malicious actor to perform TLS server substitution remotely...

SOC-L1-OSINT-Investigation-MikroTik-CVE-2018-1156

SOC L1 威胁调查：MikroTik RouterOS 多个暴露服务 分析师： Jonatan Alexander Guerrero Gomez | 目标角色： SOC L1 / 初级网络安全分析师 状态： 调查已结束 | 严重性： 高 执行摘要 主动威胁狩猎演练，识别出具有多个暴露服务的公网 MikroTik RouterOS 设备。调查将暴露在 2000/TCP 上的 Bandwidth-Test 服务与 CVE-2018-1156（一个高严重性 RCE 漏洞）关联起来。1701/UDP 上的 L2TP VPN 额外暴露增加了攻击面。此案例展示了 L1...

Mikrotrick_POC

RouterOS SSH 模数混淆验证器 CVE-2026-67276 一个自动化行为验证器，用于检测 MikroTik RouterOS 中的 SSH 公钥认证绕过漏洞 CVE-2026-67276。 该脚本通过使用仅匹配目标公钥模数的伪造签名建立握手，来测试 SSH 服务的不完整验证缺陷是否允许认证绕过。 漏洞概述 CVE-2026-67276 源于 RouterOS SSH 守护进程处理器中 RSA 公钥验证不完整。在处理客户端的公钥认证请求时，受影响版本仅匹配密钥类型和 RSA 公钥模数 $n$ ，而省略了对公钥指数 $e$ 的验证。 拥有目标用户已配置 授权公钥...

CVE-2026-89028

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a...