DEV Community

StarkMan
StarkMan

Posted on

MikroTik RouterOS CVE-2026-67276: Forged RSA Keys Can Bypass SSH Authentication

#security #mikrotik #routeros #ssh

MikroTik RouterOS CVE-2026-67276: Forged RSA Keys Can Bypass SSH Authentication

CERT-In issued CIVN-2026-0460 on September 16, 2026 with a CRITICAL rating for three MikroTik RouterOS flaws. The most serious of them, CVE-2026-67276, breaks the trust model of SSH public-key authentication. An attacker who can reach the SSH login path of an affected router can send a crafted public-key authentication request containing a forged RSA key and signature, and the incomplete verification lets the request through. Successful exploitation can bypass authentication and potentially give the attacker full administrative control of the device.

Mechanism and exploitation conditions

RouterOS does not completely verify RSA public keys during SSH authentication. A normal client proves its identity by signing a challenge with the private key that matches a stored public key. Because the verification is incomplete, a request that carries a forged key and a matching forged signature is accepted. The attacker needs network access to the SSH service on a vulnerable device and does not need a valid account.

Impact

An attacker who gains administrative control of a router can reconfigure it, read or redirect traffic, pivot into internal systems, and persist across reboots. CERT-In assesses potential impact on confidentiality, integrity and availability.

Affected products and versions

  • RouterOS 7.24 and versions before 7.24.2
  • RouterOS versions from 7.0.0 before 7.23.4
  • RouterOS versions from 6.0.0 before 6.49.21

Remediation

MikroTik published fixed releases with its September 2026 advisory. Administrators should upgrade to 7.24.2, 7.23.4, 6.49.21 or later builds as applicable. Where upgrading is not immediately possible, restrict SSH access to trusted management hosts, disable the SSH service where it is unused, and firewall the management plane. The same release also fixes CVE-2026-86060, a privilege escalation in the SSH login path, and CVE-2026-67277, a denial-of-service in the bandwidth-test service.

Sources

Top comments (0)