{"id":"CVE-2026-103903","title":"An incorrect authorization vulnerability in the WinBox\nauthentication flow of MikroTik RouterOS allows a remote authenticated attacker\nwith credentials for a low-privilege account permitted to use WinBox to obtain\nthe authorization polic…","summary":"An incorrect authorization vulnerability in the WinBox\nauthentication flow of MikroTik RouterOS allows a remote authenticated attacker\nwith credentials for a low-privilege account permitted to use WinBox to obtain\nthe authorization polic…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-863"],"published":"2026-10-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T11:17:09.517","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103903","references":[{"url":"https://br2sec.com/lv/resursi/2026-routeros-winbox-auth-bypass/","label":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},{"url":"https://cvd.cert.lv/disclosed/vuln-all-709639748","label":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},{"url":"https://forum.mikrotik.com/t/7-25rc1-testing-is-released/27352","label":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},{"url":"https://mikrotik.com/download/changelogs?channelFilter=stable&versionFilter=7.24.5","label":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"tags":["nvd"],"ingestedAt":"2026-10-12T14:50:34.104Z","slug":"CVE-2026-103903","body":"## Overview\n\nAn incorrect authorization vulnerability in the WinBox\nauthentication flow of MikroTik RouterOS allows a remote authenticated attacker\nwith credentials for a low-privilege account permitted to use WinBox to obtain\nthe authorization policy of a different existing account. The stage-one EC-SRP\nchallenge and proof are verified using the attacker's account, while the\nindependently supplied stage-two username is used to install the target\naccount's privileges. By specifying a higher-privilege account such as admin, a\nlow-privilege user can obtain a full administrative session without knowing the\ntarget account's password and can use that session to increase the privileges\nof the attacker's own account.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}