CVE-2018-1156
UnknownEPSS 7.37%
Last modified
CVE-2018-1156 is a vulnerability of currently unknown severity. Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.. EPSS estimates a 7.37% chance of exploitation in the next 30 days.
Description
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mikrotik | Routeros | < 6.40.9 |
| Mikrotik | Routeros | < 6.42.7 |
References
- https://mikrotik.com/download/changelogsVendor Advisory
- https://mikrotik.com/download/changelogs/bugfix-release-treeVendor Advisory
- https://www.tenable.com/security/research/tra-2018-21Exploit, Third Party Advisory
- https://mikrotik.com/download/changelogsVendor Advisory
- https://mikrotik.com/download/changelogs/bugfix-release-treeVendor Advisory
- https://www.tenable.com/security/research/tra-2018-21Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1156?
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.
How severe is CVE-2018-1156?
Severity scoring for CVE-2018-1156 is pending analysis. The EPSS model estimates a 7.37% probability of exploitation in the next 30 days.
How do I fix CVE-2018-1156?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-11554The forgotten-password feature in index.php/member/reset/res…
- CVE-2018-11555tificc in Little CMS 2.9 has an out-of-bounds write in the P…
- CVE-2018-11556tificc in Little CMS 2.9 has an out-of-bounds write in the c…
- CVE-2018-11557YIBAN Easy class education platform 2.0 has XSS via the arti…
- CVE-2018-11558DomainMod 4.10.0 has Stored XSS in the "/settings/profile/in…
- CVE-2018-11559DomainMod 4.10.0 has Stored XSS in the "/settings/profile/in…
- CVE-2018-11560The webService binary on Insteon HD IP Camera White 2864-222…9.8
- CVE-2018-11561An integer overflow in the unprotected distributeToken funct…7.5
- CVE-2018-11562An issue was discovered in MISP 2.4.91. A vulnerability in a…
- CVE-2018-11563An issue was discovered in Open Ticket Request System (OTRS)…4.6
- CVE-2018-11564Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a u…
- CVE-2018-11565Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.…
Are you affected by CVE-2018-1156?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST