An incorrect authorization vulnerability in the WinBox
authentication flow of MikroTik RouterOS allows a remote authenticated attacker
with credentials for a low-privilege account permitted to use WinBox to obtain
the authorization policy of a different existing account. The stage-one EC-SRP
challenge and proof are verified using the attacker's account, while the
independently supplied stage-two username is used to install the target
account's privileges. By specifying a higher-privilege account such as admin, a
low-privilege user can obtain a full administrative session without knowing the
target account's password and can use that session to increase the privileges
of the attacker's own account.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
mikrotik:routeros
References 4
https://br2sec.com/lv/resursi/2026-routeros-winbox-auth-bypass/
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
https://cvd.cert.lv/disclosed/vuln-all-709639748
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
https://forum.mikrotik.com/t/7-25rc1-testing-is-released/27352
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
https://mikrotik.com/download/changelogs?channelFilter=stable&versionFilter=7.2…
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158