CERT Polska details six MikroTik RouterOS CVEs

CERT Polska disclosed six RouterOS vulnerabilities enabling SSH auth bypass, unauthenticated RCE-like file writes, TLS impersonation, remote crash, and privilege escalation; patches available.

CERT Polska coordinated disclosure of six vulnerabilities in MikroTik RouterOS affecting SSH authentication, WebFig, X.509 validation, and the bandwidth-test service. The most severe issues include CVE-2026-67276, an SSH public-key authentication bypass caused by incomplete RSA key comparison (exponent not checked), allowing an attacker who knows an authorized RSA modulus to forge a valid signature and open an SSH session as the target user without possessing the private key. CVE-2026-67279 allows unauthenticated attackers to reach the SSH connection protocol via a rekey request without completing authentication, enabling exec requests that can create, overwrite, or reconstruct files in RouterOS's managed file namespace, including configuration and diagnostic support files. CVE-2026-67281 is an unauthenticated file-read vulnerability in WebFig's /jsproxy path, exploitable via a stale uninitialized pointer and directory traversal in an encrypted URI, disclosing root-owned files including credential stores.

Additional issues include CVE-2026-67278, a flaw in RouterOS's X.509 trust validation stemming from an e=3 root CA in the trust store and acceptance of malformed PKCS#1 v1.5 signatures, allowing an attacker who can intercept outbound TLS connections to forge a trusted intermediate certificate and impersonate arbitrary TLS servers without the root's private key. CVE-2026-67277 is an unauthenticated denial-of-service in the btest UDP service, where a related connection is accepted before primary session authentication completes, leading to leakage of uninitialized kernel memory and an integer underflow that can crash and restart the RouterOS kernel. CVE-2026-86060 is a privilege escalation via an SSH login argument-handling flaw involving prohibited leading characters in usernames, which can alter the trusted RouterOS policy mask, though it requires an unauthenticated SSH session reaching the login helper.

All six vulnerabilities were fixed in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). Given the chainable nature of these flaws — authentication bypass, file disclosure/write, TLS impersonation, and privilege escalation — RouterOS administrators should prioritize patching, especially on devices with SSH, WebFig, or bandwidth-test services exposed to untrusted networks.

title: SSH Authentication Bypass via RSA Public Key Manipulation
description: Detects SSH authentication attempts exploiting CVE-2026-67276 - incomplete
  RSA exponent validation in MikroTik RouterOS allowing signature forgery without
  the private key. Identifies ssh-connection protocol messages with RSA public-key
  auth where the signature verification logic may fail due to incomplete key structure
  checks.
tags:
- attack.credential-access
- attack.t1212
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 22
    Protocol: ssh
    EventType|contains:
    - ssh_auth
    - ssh_userauth
    AuthMethod: publickey
  filter_legitimate_rsa:
    SourceIP|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_legitimate_rsa
falsepositives:
- Legitimate SSH key-based authentication from administrative workstations
- Automated monitoring tools performing routine SSH connectivity checks
level: high
id: abf4b015-cc53-52a8-aef7-b7ec86b602d0
status: experimental
author: Vorant

title: Unauthenticated SSH Rekey Protocol Bypass in MikroTik RouterOS
description: Detects SSH rekey (newkeys) messages processed before userauth completion,
  exploiting CVE-2026-67279. Identifies protocol state violations where exec channel
  requests or file operations occur in an unauthenticated context.
tags:
- attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection_ssh_rekey:
    DestinationPort: 22
    Protocol: ssh
    EventType|contains:
    - newkeys
    - exec_channel
  selection_unauthenticated:
    UserAuthenticated: false
  selection_file_ops:
    CommandLine|contains:
    - file
    - write
    - create
    - overwrite
  condition: (selection_ssh_rekey and selection_unauthenticated) or (selection_unauthenticated
    and selection_file_ops)
falsepositives:
- SSH protocol state machines logging benign rekey events
- SSH scanners performing protocol negotiation tests
level: high
id: e6becaa0-dd32-5d5b-b2a5-057e60bb16d3
status: experimental
author: Vorant

title: WebFig Unauthenticated Directory Traversal and Credential File Access
description: Detects HTTP GET/POST requests to MikroTik RouterOS WebFig /jsproxy endpoint
  without authentication, exploiting CVE-2026-67281. Identifies directory traversal
  patterns targeting configuration and credential-related files via encrypted URI
  parameters.
tags:
- attack.credential-access
- attack.t1552
logsource:
  category: proxy
  product: linux
detection:
  selection:
    Url|contains: /jsproxy
    UserAuthenticated: false
    HttpMethod:
    - GET
    - POST
  selection_traversal:
    Url|contains:
    - ..
    - '%2e%2e'
    - etc/passwd
    - secure
    - credential
    - config
  filter_scanner:
    UserAgent|contains:
    - nmap
    - masscan
    - nikto
  condition: (selection and selection_traversal) and not filter_scanner
falsepositives:
- Legitimate web scanning by authorized penetration testers
- Misconfigurations in reverse proxies stripping authentication headers
level: high
id: b19c6fcc-9058-5a82-9127-4262382ce0c0
status: experimental
author: Vorant

Source reporting: https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve