MikroTik RouterOS CVE-2026-103903

Requires the attacker to possess valid credentials for an existing low-privilege RouterOS account that is explicitly permitted to use the WinBox service, and requires the WinBox management interface to be network-reachable from the attacker. No password for the targeted high-privilege account (e.g. admin) is needed - the attacker simply supplies the target username at stage two of the EC-SRP flow. Exploitation is limited by the need for one valid low-privilege WinBox-enabled credential (PR:L, not unauthenticated) and by whether WinBox is exposed to the attacker's network; restricting WinBox access by address, disabling it, or removing WinBox permission from low-privilege accounts reduces exposure until patched to a fixed RouterOS release (per the referenced 7.24.5 stable changelog / 7.25rc1).

This is a genuine high-priority issue for any MikroTik RouterOS operator exposing WinBox. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only a single low-privilege but WinBox-permitted account, with no user interaction. Impact is rated VC:H/VI:H/VA:H because the flaw yields a full administrative session, and the attacker can then permanently escalate their own account - effectively total device compromise. The underlying weakness (CWE-863, incorrect authorization) is a logic flaw in the EC-SRP handshake where stage-one authentication is validated against the attacker's account but stage-two privileges are installed for an independently supplied target username; this is deterministic and reliable rather than a probabilistic memory-corruption bug, so working exploitation is straightforward once understood. No EPSS score, CISA KEV listing, or explicit POC/exploit-code flag was provided in the input, so predicted exploitation probability and active-exploitation status cannot be quantified from this data; the presence of a dedicated public technical write-up (br2sec.com) and a CERT.LV coordinated-disclosure record suggests the mechanism is publicly understood even if weaponized code is not confirmed. The main mitigating factor is the PR:L prerequisite - the attacker must already hold valid credentials for a low-privilege WinBox-enabled account - which narrows this from a pure unauthenticated breach to an insider/compromised-credential or multi-tenant privilege-escalation scenario. Net: treat as high priority where low-privilege WinBox accounts exist or WinBox is network-exposed; the low complexity and deterministic logic offset the authentication requirement.

A remote attacker holding credentials for a low-privilege RouterOS account that is permitted to use WinBox initiates the EC-SRP handshake, completing the stage-one challenge and proof with their own account. In stage two they supply a different username such as 'admin', and the device installs that account's authorization policy onto the session, granting a full administrative session without ever knowing the admin password; the attacker then uses it to permanently elevate their own account. A public technical write-up describing the handshake flaw exists, but no confirmed exploit-code flag or active-exploitation signal was provided in the input.