{"id":"CVE-2026-103903","published":"2026-10-12T11:17:09.517","lastModified":"2026-10-16T17:25:57.940","description":"An incorrect authorization vulnerability in the WinBox\nauthentication flow of MikroTik RouterOS allows a remote authenticated attacker\nwith credentials for a low-privilege account permitted to use WinBox to obtain\nthe authorization policy of a different existing account. The stage-one EC-SRP\nchallenge and proof are verified using the attacker's account, while the\nindependently supplied stage-two username is used to install the target\naccount's privileges. By specifying a higher-privilege account such as admin, a\nlow-privilege user can obtain a full administrative session without knowing the\ntarget account's password and can use that session to increase the privileges\nof the attacker's own account.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://br2sec.com/lv/resursi/2026-routeros-winbox-auth-bypass/","tags":[]},{"url":"https://cvd.cert.lv/disclosed/vuln-all-709639748","tags":[]},{"url":"https://forum.mikrotik.com/t/7-25rc1-testing-is-released/27352","tags":[]},{"url":"https://mikrotik.com/download/changelogs?channelFilter=stable&versionFilter=7.24.5","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An incorrect authorization vulnerability in MikroTik RouterOS allows low-privilege WinBox users to impersonate higher-privilege accounts by manipulating the authentication flow. This enables attackers to gain full administrative access without knowing target passwords.","exploitability":"Exploitation requires a valid low-privilege account with WinBox access, making it moderately difficult but possible for attackers who already have some credentials.","blast_radius":"The vulnerability could affect many MikroTik devices in enterprise networks where WinBox is enabled, potentially allowing widespread unauthorized administrative access.","remediation":"Disable WinBox service or restrict access to it via firewall rules until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","routeros","mikrotik","winbox"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:52:31.788Z"}}