An incorrect authorization flaw in MikroTik RouterOS WinBox authentication allows a remote authenticated attacker with a low‑privilege account to gain administrative privileges by supplying the username of a higher‑privilege account. The vulnerability arises because the stage‑two username supplied by the attacker is used to assign privileges of that target account while the authentication challenge is verified against the attacker’s own credentials. The flaw is an authority bypass (CWE‑863) that permits privileged operation without the target account’s password, leading to full administrative sessions.

All MikroTik RouterOS deployments running a version prior to 7.24.5 stable are affected. The fix is included in RouterOS 7.24.5 stable, 7.25rc1 testing, or any later vendor release. Users should determine if their router runs a vulnerable version and apply the appropriate update.

The CVSS score of 8.7 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, but the high CVSS and the fact that the attacker only needs an authenticated low‑privilege account make exploitation realistic. The likely attack vector is remote via the WinBox service, which must be reachable and accept the attacker’s credentials; once connected, the attacker can supply a privileged username to obtain a full administrative session and subsequently elevate their own privileges.