WinBox vulnerability in MikroTik RouterOS turns a low-privilege account into an administrator

MikroTik has released an update that closes an authorization flaw in RouterOS’s WinBox management interface. The vulnerability, recorded as CVE-2026-103903, is rated high with 8.8 on the CVSS 3.1 scale and 8.7 on the CVSS 4.0 scale.

According to the record, the flaw stems from parts of the two-stage authentication in a WinBox session being applied to different accounts (CWE-863, incorrect authorization). The EC-SRP challenge and proof in the first stage are verified against the attacker’s own account; the username additionally sent in the second stage is used to load the target account’s privileges. As a result, a low-privileged user who is allowed to use WinBox can open a full administrator session by specifying the name of a higher-privileged account such as admin in the second stage, without knowing that account’s password. Through the same session, they can also permanently escalate their own account’s privileges.

Which versions are affected

The affected range extends from RouterOS 7.0.0 to versions before 7.24.5. The fix is included in version 7.24.5, released on the stable channel on October 1, 2026; version 7.25rc1 is not among the affected versions. So updating to 7.24.5 or later closes the vulnerability.

Who is at risk

The vulnerability is not unauthenticated: the attacker needs a valid account on the router and that account must have permission to use WinBox. Therefore, the risk is higher in setups where guest or operator accounts are shared and passwords are weak. MikroTik devices are widely used in homes and small offices, and the WinBox interface serves by default on TCP port 8291. In setups where the management interface is left exposed to the internet, the attacker’s job becomes easier.

What to do

Update RouterOS to 7.24.5 or a newer version. Do not expose the WinBox port directly to the internet; restrict management to the local network or via VPN. Delete unused accounts, strengthen the passwords of remaining accounts, and make sure each account has only the privileges needed to do its job. The vulnerability was reported under the coordination of Latvia’s CERT (CERT.LV), and the fix was published in the vendor’s release notes.

Source: NVD · CVE-2026-103903