Read the docs
TI-2026-70917 Aliases CVE-2026-103903GHSA-23wm-v672-9cvc

Incorrect authorization in MikroTik RouterOS WinBox allows privilege escalation

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

MikroTik RouterOS from 7.0.0 before 7.24.5 contains an incorrect authorization flaw in its WinBox authentication flow (CWE-863). A remote authenticated attacker with credentials for a low-privilege account allowed to use WinBox can obtain the authorization policy of a different existing account, such as admin. The stage-one challenge is verified with the attacker's account while the stage-two username selects the target account's privileges, giving a full administrative session without the target's password. The attacker can then raise the privileges of their own account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed RouterOS (MikroTik): 7.24.5, 7.25rc1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MikroTikRouterOS7.0.0 to before 7.24.57.24.5, 7.25rc1Patch availableCNA
  • RouterOS VendorMikroTik Affected 7.0.0 to before 7.24.5 Fixed in 7.24.5, 7.25rc1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*——MikroTik
  • cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* Versions — — ·MikroTik

Remediation

Update MikroTik RouterOS to version 7.24.5 or later, or to 7.25rc1, which fix the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA RouterOS (MikroTik) Fixed in 7.24.5, 7.25rc1

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-103903
  2. 2026-10-12 Alias added: GHSA-23wm-v672-9cvc
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: MEDIUM → LOW
  5. 2026-10-13 CISA SSVC decision points changed
  6. 2026-10-13 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 3

  • TI-2018-05369 A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-58872 SSH session privilege manipulation via a crafted username in Mikrotik RouterOS KEVCVSS 4.0CRITICAL 9.2
  • TI-2018-10669 MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary… KEVCVSS 3.1CRITICAL 9.1
  • TI-2026-47574 Kernel memory disclosure and denial of service in MikroTik RouterOS btest service KEVCVSS 4.0HIGH 8.8
  • TI-2026-47576 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS KEVCVSS 4.0MEDIUM 6.9
  • TI-2022-22302 Out-of-bounds read in MicroTik RouterOS CVSS 3.1CRITICAL 9.8
See all 108 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences