· zachyceno
MikroTik RouterOS WinBox Split-Principal Authentication Bypass and Privilege Escalation
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: , Summary: A remote authenticated user with read-only credentials can specify a full administrative account during stage two to obtain an admin session and persistently escalate privileges without knowing the admin password. Upgrade MikroTik RouterOS to version 7.24.5 (stable), 7.25rc1 (testing), or a later version. Verification tests confirm that the split-principal authentication flow is…
MikroTik FI