We tested the vulnerability CVE-2026-103903, an authentication bypass in MikroTik RouterOS that exploits a “split-principal” condition in the WinBox protocol. The goal was to verify whether it was possible to obtain the authorization policy of a different user (in this case, an administrator) without knowing their password, by manipulating the phases of the login process.
The test was performed on a Container Host Router (CHR) with IP 10.99.0.2 and RouterOS version 7.24.1. Two test users were created:
Reserved for members
This content is reserved for those in the dojo.
Entry is free: you subscribe to the newsletter with your email and then choose to join the dojo, without a password. How it works
