MikroTik RouterOS 7.9 < 7.23.4 / 7.24.x < 7.24.2 SSH Authentication Bypass (CVE-2026-67276)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344589);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");

  script_cve_id("CVE-2026-67276");
  script_xref(name:"IAVA", value:"2026-A-0941");

  script_name(english:"MikroTik RouterOS 7.9 < 7.23.4 / 7.24.x < 7.24.2 SSH Authentication Bypass (CVE-2026-67276)");

  script_set_attribute(attribute:"synopsis", value:
"The remote networking device is affected by an authentication bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the remote networking device is running a version of
MikroTik RouterOS 7.9 prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by
an authentication bypass vulnerability.

RouterOS does not compare the complete RSA public key when matching an SSH authentication request
to an authorized user key, checking the key type and modulus but omitting the exponent. Because
signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus
can supply a key with exponent one, forge a valid signature, and open an SSH command channel as
the target user without the private key. (CVE-2026-67276)

Note that Nessus has not tested for this issue but has instead relied only on the router's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://mikrotik.com/supportsec/september-2026-vulnerability/");
  script_set_attribute(attribute:"see_also", value:"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve");
  # https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1fe530bb");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MikroTik RouterOS 7.23.4, 7.24.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67276");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mikrotik:routeros");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mikrotik_detect.nasl", "ssh_detect.nasl");
  script_require_keys("MikroTik/RouterOS/Version");

  exit(0);
}

include('vcf.inc');

var app = 'MikroTik';
var kb_ver = 'MikroTik/RouterOS/Version';

var app_info = vcf::get_app_info(app:app, kb_ver:kb_ver);

var constraints = [
  { 'min_version' : '7.9', 'fixed_version' : '7.23.4' },
  { 'min_version' : '7.24', 'fixed_version' : '7.24.2' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING, strict:FALSE);