MikroTik RouterOS: Incorrect authorization in WinBox login allows admin takeover
Summary
MikroTik RouterOS versions from 7.0.0 up to 7.24.5 (exclusive), according to the CNA record, allow a remote attacker with a low-privilege account that has WinBox permission to gain a full administrative session. The second-stage username is not bound to the account whose password was verified, so naming a higher-privilege account such as admin grants its rights without knowing its password. The attacker can then raise the privileges of their own account. No exploitation is known, but the attack requires valid credentials.
Affected
- MikroTik RouterOS 7.0.0 to before 7.24.5 (CNA record)
- Default configuration is affected
- Older branches (6.x) are not addressed by the sources; treat them as unknown
Fixed in
- RouterOS 7.24.5 stable
- RouterOS 7.25rc1 testing (marked as unaffected by the CNA)
- Note: the fix is not listed in the 7.24.5 changelog reviewed; confirm it in the official MikroTik changelog before relying on it
Workaround
- Restrict WinBox to trusted management addresses
- Remove the WinBox permission from low-privilege accounts
- Disable WinBox if it is not required
These measures reduce exposure but do not replace the update.
Exploitation
- No confirmed exploitation in the wild
- Not listed in CISA KEV at the time of the sources
- No public proof of concept found
- CISA SSVC: exploitation none, not automatable, total technical impact
- EPSS approx. 0.4% probability of exploitation within 30 days
Our recommendation
- Inventory all RouterOS devices and flag versions below 7.24.5
- Update to 7.24.5 stable or a later release, after confirming the fix in the official changelog
- Restrict or disable WinBox where it is not needed, especially on internet-facing devices
- Remove WinBox rights from non-admin accounts and review existing accounts and groups
- Check for unknown accounts and monitor WinBox logins
- Re-check NVD and CISA KEV for updates, as the NVD status was Awaiting Analysis
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- BR²SEC advisory (Latvian) br2sec.com
- Vulners CVE record vulners.com
- Vulners CNA record (CVE List) vulners.com
- MikroTik changelogs (stable, 7.24.5) mikrotik.com
- MikroTik forum: 7.24.5 stable released forum.mikrotik.com
- HOL Guard CVE summary hol.org
- Panop threat heartbeat panop.io
- ACN/CSIRT Italia summary (Eudoria) eudoria.it
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:57.
Original description (NVD)
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.