RouterOS SSH Modulus-Confusion Validator (CVE-2026-67276)

An automated behavioral validator designed to detect the SSH public key authentication bypass vulnerability in MikroTik RouterOS (CVE-2026-67276).

The script tests whether an SSH service incomplete-validation flaw allows authentication by establishing a handshake using a forged signature matching only the targeted public key's modulus.

Vulnerability Overview

CVE-2026-67276 stems from incomplete RSA public-key verification within the RouterOS SSH daemon handler. When processing a client's public key authentication request, affected versions match only the key type and the RSA public modulus ($n$), omitting validation of the public exponent ($e$).

An operator who possesses the target user's configured authorized public key can forge a login payload. By submitting an ephemeral key blob where the exponent is set to $1$ ($e=1$) alongside the valid authorized modulus, a mathematically predictable signature matching the exact structure the verifier expects can be passed. This bypasses authentication completely without possessing or needing the corresponding private key.

Affected Versions

• Affects RouterOS stable versions prior to 7.24.2
• Affects RouterOS long-term versions prior to 7.23.4

How the Validator Works

1. Modulus Extraction: The script extracts the modulus ($n$) from a local copy of the legitimate ssh-rsa OpenSSH public key file.
2. Control Phase: It generates a completely randomized modulus and attempts an authentication sequence using the $e=1$ signature forge technique. If this succeeds, the tool safely alerts that the user target is not correctly gated, preventing a false positive.
3. Forged Phase: It executes a legitimate SSH handshake using the authorized modulus ($n$) and an exponent of $1$, automatically adjusting for standard signature types (ssh-rsa, rsa-sha2-256, or rsa-sha2-512).
4. Verdict Evaluation: If the control attempt fails properly but the forged modulus attempt is accepted, the instance is flagged as VULNERABLE.

Requirements

The validator requires Python 3 and the paramiko library for custom SSH message construction.

pip install paramiko

Usage

python3 ssh_modulus_forge_check.py -H <TARGET_IP> -u <USERNAME> -k <PATH_TO_AUTHORIZED_PUBLIC_KEY>

Options

Flag	Description	Default
-H, --host	Target host IP address or hostname.	Required
-p, --port	Target SSH port number.	22
-u, --user	Target username to validate.	Required
-k, --pubkey	Path to the legitimate .pub file bound to the target account.	Required
--sig-alg	Force signature type (ssh-rsa, rsa-sha2-256, rsa-sha2-512).	auto
--exec	Remote command to execute as proof-of-access upon success.	None
--timeout	Network and authentication connection timeouts in seconds.	10

Example Diagnostic Run

python3 ssh_modulus_forge_check.py -H 192.168.88.1 -u admin -k id_rsa.pub --exec "/system resource print"

Remediation

To protect vulnerable devices, ensure that RouterOS installations are updated to fixed releases immediately. If patching cannot be scheduled natively, restrict administrative access to the service by enforcing localized IP firewall rules (/ip firewall filter) or using RouterOS services management (/ip service) to limit allowed source addresses.

Disclaimer

This implementation is intended solely for defensive behavior verification, credential auditing, and patch compliance validation on authorized networks.