BR²SEC research has identified a high-severity incorrect authorization vulnerability (CWE-863, CVSS 8.8) in the MikroTik RouterOS WinBox authentication flow. A remote authenticated user with read-only credentials can specify a full administrative account during stage two to obtain an admin session and persistently escalate privileges without knowing the admin password.
Published: · 6 min read · Rolands Bīrons
Security Advisory: This vulnerability was discovered by BR²SEC security researcher Rolands Bīrons.
Vulnerability Summary
In the MikroTik RouterOS WinBox authentication protocol flow, the cryptographic identity established during handshake is decoupled from the authorization identity applied to the resulting session. An authenticated user possessing low-privilege credentials (such as an account in the read group) can successfully complete the initial cryptographic challenge using their own credentials, yet submit an administrative username (such as admin) in the second stage.
RouterOS verifies the low-privilege user's cryptographic proof, but installs the target account's full authorization policy for the session. This enables an unprivileged user to obtain a full administrative WinBox session and persistently escalate their own account to the full administrative group without knowing the admin password.
Affected Product and Classification
- Vendor: MikroTik (SIA Mikrotīkls)
- Product: RouterOS
- Affected Component: WinBox authentication and user service (TCP port 8291)
- Affected Versions: All RouterOS versions below 7.24.4
- Fixed Versions: RouterOS 7.24.5 stable, RouterOS 7.25rc1 testing, and later releases
- Classification:
CWE-863(Incorrect Authorization),CWE-287(Improper Authentication) - CAPEC:
CAPEC-180(Exploiting Incorrectly Configured Access Control Security Levels),CAPEC-115(Authentication Bypass) - MITRE ATT&CK:
T1078.003(Valid Accounts: Local Accounts),T1068(Exploitation for Privilege Escalation) - CVSS 3.1 Base Score: 8.8 (High) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Proposed CVSS 4.0 Base Score: 8.7 (High) —
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Impact Assessment
This vulnerability completely breaks the RouterOS Role-Based Access Control (RBAC) model: 1. Full Device Compromise: Any unprivileged account with WinBox access (such as monitoring, audit, or guest accounts) can instantly achieve full administrative control. 2. Confidentiality and Integrity Impact: An elevated session can dump router configuration backups, extract private keys, manipulate firewall and routing policies, and deploy custom packages. 3. No Administrative Password Required: The flaw bypasses authentication without password guessing or brute-force attempts, rendering exploitation immediate and reliable.
Remediation and Recommendations
Upgrade MikroTik RouterOS to version 7.24.5 (stable), 7.25rc1 (testing), or a later version. Verification tests confirm that the split-principal authentication flow is rejected by these releases.