CVE-2026-103903: MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MikroTik RouterOSto a version that resolves this vulnerability.Fixed in 7.24.5
Event History
Frequently Asked Questions
Which accounts create exposure to this issue?
Any low-privilege RouterOS account that is permitted to use WinBox can be used to exploit the issue. A higher-privilege target account must also already exist for the attacker to assume its authorization policy.
Does an attacker need the administrator password?
No. The attacker needs valid credentials for their own low-privilege WinBox-enabled account, but does not need to know the password of the higher-privilege account whose privileges they obtain.
What can an attacker do after exploitation?
The attacker can obtain a full administrative session by targeting an account such as admin. They can then use that session to increase the privileges of their own account.