## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-4RT-NET-MIKROTRICK_POC
# RouterOS SSH Modulus-Confusion Validator (CVE-2026-67276)
An automated behavioral validator designed to detect the **SSH public key authentication bypass vulnerability** in MikroTik RouterOS (CVE-2026-67276).
The script tests whether an SSH service incomplete-validation flaw allows authentication by establishing a handshake using a forged signature matching only the targeted public key's modulus.
## Vulnerability Overview
**CVE-2026-67276** stems from incomplete RSA public-key verification within the RouterOS SSH daemon handler. When processing a client's public key authentication request, affected versions match only the key type and the **RSA public modulus ($n$)** , omitting validation of the public exponent ($e$).
An operator who possesses the target user's configured **authorized public key** can forge a login payload. By submitting an ephemeral key blob where the exponent is set to $1$ ($e=1$) alongside the valid authorized modulus, a mathematically predictable signature matching the exact structure the verifier expects can be passed. This bypasses authentication completely without possessing or needing the corresponding private key.
### Affected Versions
* Affects RouterOS stable versions prior to **7.24.2**
* Affects RouterOS long-term versions prior to **7.23.4**
## How the Validator Works
1. **Modulus Extraction:** The script extracts the modulus ($n$) from a local copy of the legitimate `ssh-rsa` OpenSSH public key file.