EUVD-2026-72024
GHSA-j9wg-77fw-f22f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify RouterOS SSH-exposed device
-
DeliveryObtain authorized user's RSA modulus
-
ExploitSend key with same modulus, exponent 1
-
ExecutionForge signature accepted by verifier
-
PersistOpen SSH channel as target user
-
ImpactAdministrative device control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires (1) network reachability to the RouterOS SSH service, and (2) prior knowledge of the modulus of an RSA public key already authorized for a target user on the device - the attacker submits a key with the same type and modulus but exponent set to 1 and forges the signature. No credentials, private key, or user interaction are needed (PR:N/UI:N). The limiting factor is obtaining the authorized RSA modulus (reflected as AC:H) and that the target must have RSA public-key SSH authentication configured; devices with SSH firewalled to trusted hosts or not using RSA key auth are not remotely reachable via this path. |
| Impact | This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (9.2, AV:N/AC:H/PR:N/UI:N, VC:H/VI:H/VA:H) reflects unauthenticated network exploitation that yields full compromise of the targeted account, and a working exploit is public. The one meaningful brake is AC:H - the attacker must first learn an authorized user's RSA public modulus, which is not a network secret in principle (public keys are, by design, public and are often committed to code repos, backup exports, or config dumps) but does require reconnaissance and gates fully automated mass exploitation. Because RouterOS underpins large ISP and enterprise edge fleets and CERT-PL reports active exploitation of RouterOS bugs, even a mid-sized operator should treat SSH-facing devices as urgent and patch immediately. Signals are largely aligned (public PoC, high technical impact, reputable reporter); the main uncertainty is that active-exploitation is asserted by CERT-PL and not independently confirmed via CISA KEV in the provided data, and EPSS is not supplied. |
| Exploit ScenarioDerived | An attacker enumerates a RouterOS device with SSH exposed and obtains an authorized user's RSA public key modulus (from a leaked config export, backup, repo, or prior access). Using publicly available exploit code, they present an RSA key with the same modulus but exponent 1, forge a signature that passes RouterOS's incomplete verification, and open an SSH session as that user - gaining administrative control if the target account is privileged, with no private key required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user by exploiting incomplete RSA public-key comparison. During public-key auth RouterOS matches only the key type and modulus and ignores the exponent, so an attacker who knows an authorized user's RSA modulus can submit a key with exponent 1, forge a signature the server will validate, and open a command channel without the private key. Publicly available exploit code exists (reverse-engineered from the silent patch), and CERT-PL - the reporting party - describes the RouterOS vulnerabilities as being actively exploited, though this CVE is not confirmed in CISA KEV from the provided data.
RemediationAI
Upgrade to a fixed RouterOS release for your branch: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable), per the MikroTik advisory (https://mikrotik.com/supportsec/september-2026-vulnerability/) and the release notes (forum.mikrotik.com posts for 6.49.21, 7.23.4, 7.24.2). Until patched, restrict exposure of the SSH management service: disable SSH if unused, or firewall it to trusted management IPs only (RouterOS IP services / firewall filter), which prevents remote reach at the cost of remote SSH administration. As a stronger interim control, disable RSA public-key SSH authentication and rely on other allowed auth mechanisms where feasible, and rotate/re-issue SSH keys after patching since an authorized modulus may have been observed; note that changing auth methods can disrupt automation that logs in via key. Also review logs for unexpected SSH logins as privileged users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RouterOS is MikroTik's proprietary network operating system running on RouterBOARD hardware and CHR virtual instances, exposing an SSH management service. The flaw is a CWE-347 Improper Verification of Cryptographic Signature: SSH RSA public-key authentication should bind a stored authorized key to an exact (modulus, exponent) pair, but RouterOS's matching logic compared only the key type and the modulus n, silently accepting any exponent e. Signature verification then used the client-supplied key rather than the stored one. RSA verification recovers m = s^e mod n; with a chosen public exponent e=1, verification collapses to m = s mod n, so an attacker can trivially select a signature s that satisfies the check for any challenge without possessing the private key d. The affected CPE is cpe:2.3:a:mikrotik:routeros:*:*:*:*:*:*:*:*.
Know when Routeros gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network SSH bypass yielding full account/device control (C/I/A:H); AC:H because the attacker must first know an authorized user's RSA modulus.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue was fixed in versions: 6.49.21 (Lont-term), 7.23.4 (Lont-term) and 7.24.2 (Stable)
Articles & Coverage 1
Technical POC Analysis
CWE-347 - Improper Verification of Cryptographic Signature.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
MikroTik RouterOS contains a critical remote authentication bypass in SSH public-key validation that allows unauthenticated attackers to log in as authorized users without valid credentials. This vulnerability directly compromises the integrity of network infrastructure used by organizations worldwide and poses immediate risk of device takeover, lateral network movement, and data exfiltration.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable SSH entirely on RouterOS devices without active management requirements; (2) Restrict SSH access via network-layer firewall rules to whitelisted management subnets only; (3) Require VPN connectivity as a prerequisite for any RouterOS SSH access; (4) Implement centralized logging and real-time alerting on all SSH authentication events; (5) Change default SSH ports from 22 to non-standard alternative; (6) Disable password authentication and restrict to key-based methods on remaining SSH services; (7) Maintain continuous vendor monitoring for emergency security advisories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-a
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
Exploit-DB