[msuiche]

Summary

Adds vuln-mikrotik-fd2-inject, a check for CVE-2026-86060 (MikroTik RouterOS SSH login-helper fd injection), completing sshamble's coverage of the three SSH-side CVEs from the CERT Polska advisory alongside the existing vuln-mikrotik-pubkey-bypass (67276) and vuln-mikrotik-preauth-rekey (67279).

How detection works

The login helper parses a positional argv starting with - as -<fd> and reads the trusted (name, policy-mask) fields from that descriptor. A username of -2 makes it read them from the PTY. The check:

1. Presents username -2 with none auth (rejected as expected; the username stays pending)
2. Requests a pre-auth rekey (the CVE-2026-67279 primitive, via RequestKeyExchange from add mikrotik CVE-2026-67279 pre-auth rekey session check #50) to open the session channel unauthenticated
3. Requests PTY + shell and writes the canonical-PTY fd-2 block (name \0 policy \0 VEOF VEOF)
4. Drives the console (DECID/CPR answers with the requested 24x80 geometry) and runs a read-only /system resource print as proof

Why the signal is specific to 86060

Variant testing against CHR 7.24.1 shows the console appears only with the full combination:

variant	result
-2 + rekey + fd-2 block	full-admin console
-2 + rekey, no fd-2 block	channel opens, no console (67279 signal)
rekey + fd-2 block, no -2	channel opens, no console
rekey only	channel opens, no console

So the console prompt cannot be a false positive from CVE-2026-67279 alone. RouterOS attribution (ROSSSH banner or MikroTik output) is still required before the CVE is reported, mirroring the rekey check.

Verification

• Positive: CHR 7.24.1 and 7.23.3 lab VMs — console obtained, version: 7.24.1 (stable) / platform: MikroTik captured as proof
• Negative: standards-compliant Go sshd — channel open refused, check not reported
• Unit tests for the console transcript parsing (including the vertical-rendering edge case that breaks naive prompt regexes)

Also in this PR

Drops the temporary replace to my excrypto fork now that v0.43.2 is tagged including UnauthClientConn.RequestKeyExchange (#89), so go.mod resolves the tagged upstream release.

Detection-only as with the previous PRs: the fd-2 block is the minimal trigger required to observe the vulnerability; the check executes nothing beyond a read-only version print.