CVE-2018-7445

What it actually does

A stack-based buffer overflow in the SMB service when processing NetBIOS session request messages allows unauthenticated remote code execution on all architectures.

Why it matters to the business

Compromise of network infrastructure devices enabling persistent attacker access, data exfiltration, or use as an internal pivot point; CISA KEV listing with 2022-09-29 due date indicates high urgency and known exploitation.

How an attack unfolds

An unauthenticated attacker sends a crafted NetBIOS session request message to the exposed SMB service; the message triggers the buffer overflow before authentication, allowing arbitrary code execution. Threat actor references to MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability indicate active-in-the-wild use.

How to fix it

Upgrade RouterOS to 6.41.3, 6.42rc27, or later fixed releases on all affected devices; restrict SMB exposure via firewall rules until patched.

How to confirm the fix worked

Confirm device RouterOS version is 6.41.3 or newer; perform version checks via Winbox or SSH and re-test SMB service reachability after upgrade.

Typical attack path

1. Discover exposed MikroTik devices with SMB service reachable on TCP 139/445
2. Send malicious NetBIOS session request packet to trigger the overflow
3. Achieve unauthenticated remote code execution and install persistence or move laterally

How to detect it

Review firewall and SMB service logs for unexpected external connections to ports 139/445; search for unusual NetBIOS session request patterns or post-auth anomalies after unauthenticated sessions.

What your security team should do

• Prioritize patching of all RouterOS devices due to KEV status and active exploitation
• Disable or firewall-restrict SMB service where not required
• Monitor network traffic for anomalous NetBIOS session requests to SMB ports