PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-14847 MikroTik CVE debrief

CVE-2018-14847 is a MikroTik RouterOS directory traversal vulnerability that CISA has included in the Known Exploited Vulnerabilities catalog. The KEV listing is the key defensive signal here: it indicates known exploitation and directs defenders to apply vendor updates without delay.

Vendor
MikroTik
Product
RouterOS
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2021-12-01
Original CVE updated
2021-12-01
Advisory published
2021-12-01
Advisory updated
2021-12-01

Who should care

Administrators and security teams responsible for MikroTik RouterOS deployments, especially those tracking or remediating CISA KEV-listed vulnerabilities.

Technical summary

The official source corpus identifies CVE-2018-14847 as a directory traversal issue in MikroTik RouterOS. CISA’s KEV entry marks it as a known exploited vulnerability and recommends applying updates per vendor instructions. The supplied sources do not include a vendor advisory or fixed-version details.

Defensive priority

High — CISA KEV inclusion means this vulnerability should be prioritized for prompt remediation and asset verification.

Recommended defensive actions

  • Inventory MikroTik RouterOS systems across the environment.
  • Check the CISA KEV entry and follow vendor update instructions for CVE-2018-14847.
  • Apply RouterOS updates as soon as practical.
  • If immediate patching is not possible, restrict access to the affected systems until remediation is complete.
  • Reconfirm remediation after updates are applied.

Evidence notes

CISA’s Known Exploited Vulnerabilities feed lists CVE-2018-14847 as a MikroTik RouterOS directory traversal vulnerability, added on 2021-12-01 with a due date of 2022-06-01 and the required action “Apply updates per vendor instructions.” The official CVE and NVD records are provided as reference links in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-14847 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-14847

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-14847 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-14847

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.