RouterOS SSH Authentication Bypass via RSA Key Forgery

Executive Summary

CVE-2026-67276 is a flaw in MikroTik RouterOS where the system does not fully verify RSA public keys during SSH authentication. It checks the key type and modulus but ignores the exponent, allowing an attacker who knows the authorized modulus to forge a valid signature by supplying a key with exponent one. This bypasses private key requirements and grants unauthorized SSH access to the target user's account.

Useful 0 Not Useful 0

Detection Guidance

Check RouterOS version using '/system package print' or '/system resource print' commands. If the version is below 6.49.21, 7.23.4, or 7.24.2, the system is vulnerable. Monitor SSH logs for unauthorized access attempts or unexpected user logins.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized SSH access to your MikroTik RouterOS device, potentially taking control of the system, executing commands, or accessing sensitive data. Devices with SSH exposed to the internet are at higher risk. The vulnerability allows full account access without the private key, posing significant security risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized SSH access to MikroTik RouterOS devices, potentially exposing sensitive data or system control. For GDPR, it could lead to unauthorized access to personal data, violating confidentiality requirements. For HIPAA, it may enable unauthorized access to protected health information, compromising security controls. Both standards require robust access controls and encryption, which this flaw undermines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade RouterOS to version 6.49.21, 7.23.4, or 7.24.2 or later immediately. Disable SSH access if not required or restrict it to trusted IPs. Review user accounts and SSH keys for unauthorized entries.

Useful 0 Not Useful 0