Description

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-12T11:17:09.517Z",
  "pubdate": "2026-10-12T11:17:09.517Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw within the WinBox authentication flow of MikroTik RouterOS. The defect allows a remote attacker possessing valid credentials for a low-privilege account to escalate their access level by misusing the multi-stage authentication mechanism.\nBy manipulating the session initialization process, an attacker can bypass authorization constraints and obtain the privileges associated with a different, higher-privilege account, such as the administrator account. This results in a full administrative session, granting the attacker complete control over the affected system.\nThe vulnerability requires the attacker to already hold legitimate, low-privilege credentials for WinBox access. Successful exploitation enables unauthorized privilege escalation, facilitating full system compromise and persistent access. The flaw resides in the decoupled validation of the EC-SRP challenge and the target username during the session establishment phase.",
  "technicalDetails": "The vulnerability exists in the WinBox authentication process, specifically during the handling of the stage-one and stage-two authentication stages. WinBox utilizes an EC-SRP (Elliptic Curve Secure Remote Password) protocol for secure authentication. The flaw arises due to an inconsistency in how the authorization policy is bound to the validated user session.\nThe exploitation flow proceeds as follows: First, the attacker initiates an authentication sequence using their own legitimate low-privilege credentials. The system correctly verifies the attacker's identity during the stage-one EC-SRP challenge and proof process. However, the system fails to maintain the integrity of this identity throughout the subsequent stage-two phase.\nDuring the second stage, the attacker transmits an independently supplied username in the request. The service erroneously uses this second, target username to install the authorization policy for the session, rather than enforcing the policy associated with the identity authenticated in stage one. By injecting the username of a target account—typically 'admin'—the attacker influences the authorization logic to apply the permissions of the higher-privilege user to the established session.\nThe vulnerability is fundamentally a failure in the state machine's session binding logic. The server creates a session bound to the privileges of the target user specified in the second stage, despite the cryptographic proof of identity having been satisfied only for the low-privilege user. This decoupling allows a low-privilege user to successfully masquerade as a high-privilege user without ever possessing the target's password.\nPost-exploitation impact is severe, as the attacker gains an authenticated session with administrative privileges. This session allows for the modification of system configurations, the creation of new accounts, or the explicit elevation of the attacker's original low-privilege account to permanent administrative status. Because this occurs within the legitimate WinBox management protocol, it is difficult to distinguish from standard administrative activity without deep inspection of the authentication sequence."
}