RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type…
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- MikroTik
- Product
- RouterOS
- Fix
- available
- Exposure class
- Edge / VPN / firewall
Why it ranks 17 (Routine)
- Exposed product class: edge / VPN / firewall
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-67276 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.