CVE-2026-67276

Medienbericht

Exploit

EPSS 0.25%
Veröffentlicht 05.09.2026 20:00:55
Zuletzt bearbeitet 25.09.2026 14:57:53
Erkennungen
Login

SSH user impersonation possible in Mikrotik RouterOS

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 14

NVD 2 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mikrotik ≫ Routeros Version >= 7.9 < 7.23.4

Mikrotik ≫ Routeros Version >= 7.24 < 7.24.2

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.25%	0.161

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cvd@cert.pl	9.2	0	0	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X