CVE-2026-103903: MikroTik RouterOS Auth Bypass Vulnerability

CVE-2026-103903 Overview

CVE-2026-103903 is an incorrect authorization vulnerability [CWE-863] in the WinBox authentication flow of MikroTik RouterOS. A remote authenticated attacker holding credentials for a low-privilege account with WinBox access can obtain the authorization policy of any other existing account. The flaw stems from a split between the two authentication stages: the stage-one Elliptic Curve Secure Remote Password (EC-SRP) challenge is validated against the attacker's account, while the stage-two username is used to assign privileges. By specifying a higher-privilege account such as admin, the attacker gains a full administrative session without knowing the target password and can then elevate their own account.

Critical Impact

An authenticated low-privilege WinBox user can escalate to full administrative control of the RouterOS device over the network.

Affected Products

• MikroTik RouterOS versions prior to 7.24.5 (stable channel)
• MikroTik RouterOS release candidates prior to 7.25rc1
• Devices exposing the WinBox management service to reachable networks

Discovery Timeline

• 2026-10-12 - CVE-2026-103903 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-103903

Vulnerability Analysis

The vulnerability resides in the two-stage WinBox authentication handshake used by RouterOS. Stage one performs an EC-SRP challenge-response exchange that mathematically proves the client knows the password for a stated account. Stage two accepts a username and installs the corresponding authorization policy into the session.

These stages are not bound to the same identity. The server verifies the EC-SRP proof using the attacker's own account credentials, then trusts the independently supplied stage-two username to look up the authorization policy. The identity used for cryptographic authentication and the identity used for authorization are therefore decoupled.

Root Cause

The root cause is an authorization decision that relies on an unauthenticated field rather than the identity verified during stage one. This is a classic incorrect authorization pattern [CWE-863]: the system successfully authenticates principal A, then authorizes the session as principal B because policy lookup consumes a separate, attacker-controlled username value.

Attack Vector

Exploitation requires network reachability to the WinBox service and valid credentials for any low-privilege account permitted to use WinBox. The attacker completes stage one normally with their own username and password, satisfying the EC-SRP proof. During stage two, the attacker submits admin or another high-privilege account name. RouterOS installs that account's full policy into the session, granting administrative capabilities. The attacker then uses that session to grant persistent elevated privileges to their original account. See the Br2Sec WinBox Auth Bypass writeup and the CERT Vulnerability Disclosure for protocol-level details.

// Vulnerability flow (described, not executable)
// stage1: EC-SRP(username = low_priv_user, password = known) -> proof OK
// stage2: policy_lookup(username = "admin") -> session granted admin policy
// result: authenticated as low_priv_user, authorized as admin

Detection Methods for CVE-2026-103903

Indicators of Compromise

• WinBox sessions where the authenticating account differs from the account whose privileges are applied in subsequent configuration changes.
• Unexpected modifications to the /user configuration, especially group promotions of previously low-privilege accounts to full.
• New or modified entries in /user ssh-keys or /user scheduler scripts shortly after a non-admin WinBox login.
• Logins from low-privilege accounts followed immediately by administrative actions such as package installs or firewall rule changes.

Detection Strategies

• Correlate RouterOS logging topics system,info,account and system,error,critical to flag privilege-group changes initiated by non-admin users.
• Enable remote syslog export and alert on user changed by events where the acting user does not belong to the full group.
• Hunt for WinBox TCP connections to port 8291 from unexpected source addresses or during off-hours.

Monitoring Recommendations

• Forward RouterOS logs to a central logging platform and retain WinBox authentication events for review.
• Baseline normal administrative accounts and alert on new accounts added to the full group.
• Monitor for configuration exports or backup downloads following any non-admin WinBox session.

How to Mitigate CVE-2026-103903

Immediate Actions Required

• Upgrade RouterOS to 7.24.5 or later on the stable channel, or 7.25rc1 or later on the testing channel.
• Restrict WinBox access using the /ip service address list so only trusted management networks can reach TCP 8291.
• Audit all accounts in /user print and remove or demote any unexpected members of the full group.
• Rotate credentials for every account that can access WinBox, including read-only accounts.

Patch Information

MikroTik addressed the issue in RouterOS 7.24.5 on the stable channel and 7.25rc1 on the testing channel. See the MikroTik Changelog for 7.24.5 and the MikroTik Forum Release Announcement for release details.

Workarounds

• Disable the WinBox service with /ip service disable winbox where management is possible over SSH or the API with equivalent restrictions.
• Place WinBox behind a VPN or jump host so the service is not reachable from user or internet-facing networks.
• Remove WinBox permission from all non-administrative user groups by editing group policies with /user group.

# Restrict WinBox to a trusted management subnet and enforce TLS-only alternatives
/ip service set winbox address=192.0.2.0/24
/ip service disable telnet,ftp,www
/user group set read policy="local,read,test,!winbox,!api,!ssh"