Is the password stored as a hash?

No, it is not a resistant hash. It is the result of an XOR between the password and a key derived from the MD5 of the username and a static constant. This makes the transformation invertible offline.

Does the issue also affect RouterOS v7?

The report indicates that the fix has been present since 6.40.8 and that 7.x versions are mitigated. The vulnerability is specific to v6 versions prior to the fix.

Can I recover the password if I only have the user.dat file?

Yes, if the router version was vulnerable (pre-6.40.8), it is possible to recover the plaintext password offline by applying the XOR formula with the known constant 283i4jfkai3389.

LabLab · CVE-2018-14847

CVE-2018-14847: Recovering plaintext passwords from user.dat on RouterOS v6

Image generated locally with ComfyUI from randomly selected elements. How the images are created

We reproduced the CVE-2018-14847 vulnerability on RouterOS v6, confirming that an unauthenticated attacker can read the user.dat file and recover plaintext passwords due to a weak XOR transformation. The issue is fixed in versions 6.40.8, 6.42.11, and 6.49.7, where access to the file is denied.

by Gianni Olivieri | MikroTik Dojo Published on 9 October 2026 Updated on 10 October 2026 2 min read

We verified the possibility of reading the credentials file user.dat without authentication via the API (8728) or WinBox (8291) ports on various RouterOS v6 versions. Additionally, we analyzed the password field structure to determine if it was possible to derive the plaintext password offline.

The test was performed on an isolated home-lab (network 10.13.0.0/24) with no Internet access. Four virtual routers (CHR) were used with the following versions:

Reserved for members

This content is reserved for those in the dojo.

Entry is free: you subscribe to the newsletter with your email and then choose to join the dojo, without a password. How it works