CVE-2018-1156: MikroTik RouterOS

High severity, CVSS 8.8. EPSS: 7.4% chance of exploitation in the next 30 days.

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.

Affected products

• MikroTik RouterOS: before 6.40.9 (fixed in 6.40.9); before 6.42.7 (fixed in 6.42.7)

Published 2018-08-23. Last modified 2026-06-17.