Vulnerabilidad · Publicado 12/10/2026
Una falla en el flujo de autenticación WinBox de MikroTik RouterOS permite que un atacante autenticado con credenciales de bajo privilegio obtenga acceso a políticas de autorización de otras cuentas. Esta vulnerabilidad afecta infraestructuras de red altas en LATAM donde RouterOS es ampliamente utilizado en ISPs, empresas y centros de datos. El atacante remoto puede escalar privilegios sin requerir credenciales administrativas.
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.
Score: 8.8/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-863
Publicado en NIST NVD.