Exploitation of CVE-2018-14847 in MikroTik RouterOS

CVE-2018-14847 is a critical vulnerability affecting the Winbox service in MikroTik RouterOS, enabling unauthenticated attackers to perform arbitrary file reads. The vulnerability resides in how the service handles file requests, specifically allowing unauthorized access to the 'user.dat' file, which contains device account credentials. The passwords stored within this file are protected by a weak XOR-based obfuscation using a static key derived from a hardcoded salt. Publicly available exploit scripts automate the entire attack chain, from establishing the Winbox session to extracting and decrypting credentials. This vulnerability impacts MikroTik RouterOS versions up to 6.42. Defenders should prioritize patching, as the presence of functional exploit code significantly lowers the barrier for attackers to gain full administrative control over exposed routing infrastructure.

Attack Chain

1. The attacker performs network scanning to identify reachable Winbox services on TCP port 8291.
2. The attacker establishes an initial session with the Winbox service by sending a crafted 'FIRST_PAYLOAD'.
3. The service responds, and the attacker extracts the session ID from the 38th byte of the response.
4. The attacker injects the extracted session ID into a 'SECOND_PAYLOAD' at the 19th byte position.
5. The attacker sends this second payload to request the sensitive file '/flash/rw/store/user.dat'.
6. The service returns the file content to the attacker, including encrypted user credentials.
7. The attacker parses the data for 'M2' entries and applies XOR decryption using the MD5 hash of the username concatenated with a hardcoded salt.
8. The attacker obtains plain-text administrative credentials and gains full access to the router.

Impact

Successful exploitation results in the immediate exposure of all local administrative credentials stored on the router. Given the high-privilege nature of these accounts, attackers can gain complete control of the network device, leading to traffic interception, modification of network configuration, deployment of backdoors, or the utilization of the compromised router as an entry point for further lateral movement within the organization.

Recommendation

Prioritize patching all internet-facing or internal MikroTik RouterOS devices to the current long-term or stable release versions, specifically ensuring the system is at or above version 6.42.1 (for stable) or 6.40.8 (for long-term). Block external access to TCP port 8291 via perimeter firewalls if Winbox management is not strictly required from remote locations. Use the Sigma rule below to monitor for mass scanning or exploitation attempts targeting the Winbox service.