CVE-2026-103903 in MikroTik
Summary
by MITRE • 10/12/2026
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability described constitutes a critical authorization bypass within the WinBox authentication mechanism of MikroTik RouterOS, specifically exploiting flaws in how multi-stage challenge-response protocols handle identity verification and privilege assignment. This flaw allows an authenticated attacker operating under a low-privilege account that has been granted access to the WinBox interface to escalate privileges arbitrarily without possessing valid credentials for higher-level accounts such as admin. The core technical issue lies in the decoupling of authentication validation from authorization enforcement during the second stage of the EC-SRP (Elliptic Curve Secure Remote Password) protocol implementation. In a secure design, the identity used to verify the cryptographic proof must strictly match the identity being authenticated and authorized; however, this vulnerability permits an attacker to supply their own valid credentials for the initial challenge-response verification while simultaneously injecting a different username in the subsequent stage intended to establish the session context.
From a technical perspective, the exploitation relies on the specific flow of the WinBox authentication sequence where the server verifies the cryptographic proof derived from the attacker's low-privilege account but then blindly accepts an independently supplied target username for privilege installation. This logic error means that while the system correctly confirms the attacker possesses valid credentials for their own account, it fails to bind those verified credentials to the requested identity in a way that prevents impersonation of other users. By specifying a high-privilege account like admin during this second stage, the router installs the administrative privilege set associated with that target user onto the active session established by the attacker's low-privilege authentication. This effectively creates an authorization policy where the cryptographic proof validates access but does not restrict it to the identity of the prover, allowing for a complete bypass of password-based security controls for any existing account on the system.
The operational impact of this vulnerability is severe, as it enables remote privilege escalation from a standard user level directly to full administrative control without requiring brute-force attacks or credential theft. Once an attacker obtains a session with admin privileges through this method, they can modify router configurations, install malicious packages, exfiltrate sensitive network data, and further escalate their own account's permissions permanently within the system. This undermines the fundamental principle of least privilege and compromises the integrity of the entire managed infrastructure, as the attacker gains unrestricted access to all security policies, firewall rules, and user management interfaces. The ability to manipulate authorization policies means that subsequent attacks can be launched with full authority, potentially leading to total network compromise or use of the router as a pivot point for lateral movement within an enterprise environment.
This vulnerability aligns closely with CWE-269 Improper Privilege Assignment and CWE-862 Missing Authorization in its failure to enforce proper access control checks relative to user identities during session establishment. In terms of offensive security frameworks, this behavior is characteristic of ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to gain initial access, combined with aspects of privilege escalation techniques that exploit logic flaws rather than software bugs in the underlying operating system or kernel. The attack vector is remote and requires only valid low-privilege WinBox credentials, making it highly exploitable against any organization running vulnerable versions of RouterOS with exposed management interfaces.
Mitigation strategies must focus on immediate patching to address the flawed authentication logic within the WinBox service. Administrators should update MikroTik RouterOS to a version that corrects the binding between cryptographic proof verification and identity-based authorization checks, ensuring that the username used for privilege installation matches the authenticated user's actual privileges or requires re-authentication with target credentials. Until patches are applied, it is advisable to restrict WinBox access via firewall rules to only trusted IP addresses, disable unnecessary services, and enforce strict network segmentation to limit exposure of management interfaces. Additionally, implementing multi-factor authentication where available can add a layer of defense-in-depth that may mitigate the impact if such logic flaws exist in future updates, although patching remains the primary remediation step for this specific implementation error.