I read in a discussion on an other website about the last vulnerability (April 2018) that Winbox was downloadable straight from the router? It should be then in side the firmware or side loaded into the router.
I am not that long, a owner of Mikrotik equipment so my memory is limited in this.