GCVE-110-NCSC-2026-345

Advisory Published

Vulnetix · Advisory published September 8, 2026

RouterOS 7.x contained a critical SSH authentication vulnerability where only the RSA key type and modulus were verified, ignoring the exponent, enabling signature forgery and unauthorized access, fixed in versions 7.23.4 and 7.24.2.

Download JSON Open in Console

Weaknesses (CWE)

CWE-347Improper Verification of Cryptographic SignatureCWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')CWE-306Missing Authentication for Critical Function

Affected Products

Vendor	Product	Versions	Platforms
MikroTik	vers:unknown/*	—	—

Aliases

CVE-2026-67276 CVE-2026-67277 CVE-2026-86060

References

advisory

exploit

advisory

Browse GCVE Records

540 records in the GCVE database · Updated September 8, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON