CVE-2026-67276

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2

Description An issue exists in the SSH protocol implementation where the system fails to compare the complete RSA public key when matching an authentication request to an authorized user key. Specifically, the system verifies the key type and modulus but omits the exponent. Since signature verification relies on the client-supplied key, an attacker who knows an authorized RSA modulus can provide a key with an exponent of one to forge a valid signature. This allows the attacker to bypass security restrictions and open an SSH command channel as the target user without possessing the private key, potentially granting full control over the device. This issue has been actively exploited in the wild.

Recommendations Update to version 6.49.21 (Long-term). Update to version 7.23.4 (Long-term). Update to version 7.24.2 (Stable).