MikroTik security findings, explained
Every finding the audit can report has its own page: what it means, why it matters, what it looks like in Winbox, and the exact RouterOS commands that fix it. Written for people who run a MikroTik router, not only for security specialists.
API-SSL is enabled but nothing uses it
RouterOS enables the TLS API by default, and most routers never have an application talking to it. A management service that nothing uses is attack surface without a benefit. Disable it, or restrict it to the one address that needs it.
Automatic SMB sharing of attached storage is enabled
With auto-sharing on, any USB stick or SD card plugged into the router is published over SMB the moment it is inserted. That is convenient until somebody plugs in the wrong drive. Disable it unless the router is deliberately used as a file share.
Bandwidth-test server reachable from the internet
The RouterOS bandwidth-test server is on by default and answers on TCP port 2000. When the internet can reach it, anyone with a router login can saturate your uplink, and it is one more place to guess passwords.
The default "admin" account is still in use
Every brute-force attempt against a MikroTik starts with the user name "admin". Keeping that account active hands attackers half of the login for free. Create a personal full-access account with a different name and disable admin.
Default SSID "MikroTik": what a factory network name tells attackers
A WiFi network still called MikroTik or MikroTik-XXXXXX announces the make of your router to everyone in range and suggests the rest of the setup is factory default too. It is not a hole, but it is a signpost. Renaming it takes one command.
Default system identity "MikroTik"
Your router still carries the factory name "MikroTik". This is not a security hole, but a unique identity keeps logs, backups, neighbour lists and monitoring unambiguous, and it stops the device advertising that the rest of its setup may be default too.
Your export contains passwords in readable form
The configuration file you uploaded includes WiFi keys, VPN secrets or similar credentials in plain text. That is normal for an export made with show-sensitive, and it let the audit check them — but the file itself now needs handling with care.
Forward chain lets the internet reach your internal network
The forward chain decides which traffic may pass through the router between networks. Without a rule that drops new connections from WAN, NAT is the only thing standing between the internet and your LAN — and NAT is not a firewall.
FTP is enabled: credentials and files travel unencrypted
The FTP service on your MikroTik is on, as it is in every factory configuration. It sends the router's admin password in plain text and is a favourite brute-force target. Disable it and use SFTP over SSH instead.
Full-access users can log in from any address
Accounts in the full group on your router have no address restriction, so a leaked password works from anywhere. Limiting admin logins to your management subnet adds a second barrier that costs nothing to maintain.
Guest network is not isolated from the main LAN
You have a guest, hotspot or public segment on your router, but no firewall rule stops traffic from it reaching your private network. A visitor's device can browse to your NAS, printers and workstations as if it were on the LAN.
Hotspot users with trivial passwords
One or more accounts on your hotspot have passwords that are short, common or easy to guess. For a shared guest login that is usually fine; it becomes a problem when such an account has more rights than a visitor should.
Input chain does not drop unsolicited traffic from the internet
Your router has input firewall rules, but none of them stops a new connection arriving from the WAN side. RouterOS then accepts it by default, so every enabled service is still reachable from the internet.
IPsec uses weak algorithms (DES, 3DES, MD5)
An IPsec proposal or profile on your router still allows DES, 3DES or MD5. These algorithms are decades old and no longer considered safe for protecting traffic. Moving to AES-256 with SHA-256 and a modern DH group is a one-line change.
IPv6 is active but there is no IPv6 firewall
Your router has IPv6 connectivity but not a single rule in the IPv6 firewall. Because IPv6 has no NAT, that leaves the router and every device on your LAN reachable from the internet, regardless of how good your IPv4 firewall is.
IPv6 forward chain lets the internet reach internal devices
Over IPv6 every device on your LAN has a public address, and there is no NAT to hide behind. Without a drop rule in the IPv6 forward chain, the internet can open connections straight to your PCs, printers and cameras. One rule closes it.
L2TP client runs without IPsec
An L2TP client tunnel on your router is configured without IPsec. L2TP on its own carries traffic in the clear, so everything in the tunnel can be read by anyone on the path. Enabling IPsec fixes it.
L2TP server does not require IPsec
Your L2TP VPN server accepts clients that connect without IPsec. L2TP by itself provides no encryption, so such a client sends its login and all its traffic across the internet in the clear. Only use-ipsec=required enforces protection.
Logs are kept only on the router
RouterOS keeps its log in memory. It is gone after a reboot, and anyone who takes over the router can erase it. Sending a copy to a syslog server is the difference between knowing what happened and guessing.
MAC-Telnet and MAC-Winbox available on all interfaces, including WAN
MAC-Telnet and MAC-Winbox let you manage a router by its hardware address instead of an IP address. When they are allowed on the WAN port, everyone in the ISP segment can try to log in, and the IP firewall cannot stop them.
MikroTik Cloud DDNS is enabled: convenient, and easy to find
With Cloud DDNS on, your router publishes its public address under a name that is derived from its serial number. That is handy for VPNs and harmless in itself, but it makes the device easy to locate, so management must not be reachable from the internet.
Neighbour discovery (MNDP/CDP/LLDP) active on the WAN side
Neighbour discovery announces your router's model, RouterOS version, identity and addresses to every device on the same segment. On the WAN port that audience is your ISP and its other customers. Limit it to the LAN.
No brute-force protection for internet-facing management
A management service on your router answers to the whole internet and nothing limits repeated login attempts. Scanners will guess passwords around the clock. The real fix is to stop exposing management; a staged address-list firewall is the safety net.
No firewall rules on the input chain: your router accepts every connection
The input chain is the firewall that protects the router itself. When it is empty, every service on the device — Winbox, SSH, the API, DNS — is open to whoever can reach the WAN port. This is the single most serious finding the audit can report.
No rule dropping invalid connections
Your input chain has no rule that drops packets in the invalid connection state. These packets belong to no known connection and are used by scanners and firewall-evasion tools. One line fixes it.
NTP time synchronisation is not configured
Your router does not synchronise its clock. Most MikroTik devices have no battery-backed clock, so after every reboot the time starts from a fixed date. Certificates then fail to validate and logs become useless for working out what happened when.
Open DNS resolver: your router answers DNS queries from the whole internet
The DNS resolver on your MikroTik is meant to serve your LAN, but nothing stops the internet from using it too. Open resolvers are abused for amplification DDoS attacks, and ISPs regularly disconnect customers for running one.
Open WiFi network without encryption
One of your access points broadcasts a network with no WPA2 or WPA3 at all. Anyone in range can join, and everything clients send without HTTPS can be read from the car park. Here is how to add encryption, or isolate the network if it must stay open.
Outdated RouterOS version with known vulnerabilities
Your router runs a RouterOS release that is behind current and has published security fixes it does not contain. This article explains what the version finding covers, why old MikroTik firmware gets exploited so reliably, and how to upgrade safely.
Packet sniffer is streaming your traffic to a remote host
The built-in packet sniffer on your MikroTik is configured to stream a copy of network traffic to another machine. Unless you set this up yourself for troubleshooting, somebody else is intercepting what passes through your router.
Port forwards published to the internet: why every one needs a review
Your router forwards one or more ports from the internet to devices inside your network. None of them is a known high-risk service, but every published port is attack surface for the device behind it. This is a reminder to review the list.
PPTP VPN client is configured
Your router connects out to a remote site or provider over PPTP. The encryption in PPTP has been broken since 2012, so anyone who records the tunnel can read what went through it and recover the password. Move the connection to WireGuard, IKEv2 or SSTP.
PPTP VPN server is enabled: a VPN that has been broken since 2012
PPTP was the easy VPN of the early 2000s. Its authentication and encryption were shown to be breakable in 2012, so a captured session can be decrypted and the password recovered. Here is how to replace it.
A port forward exposes RDP, SMB or a camera to the internet
A dst-nat rule on your router publishes a service that was never designed to face the internet, such as Remote Desktop, Windows file sharing or a camera recorder. This is how many ransomware incidents begin. Here is how to close it without losing access.
RoMON is enabled without a secret
RoMON lets you manage MikroTik devices through each other at layer 2, even without IP addresses. Without a secret, any RoMON-capable device plugged into the same segment can join that management network. Set a secret or switch RoMON off.
Router management reachable from an open WiFi
Your open wireless network is bridged to an interface from which the router's own login services can be reached. Anyone within radio range can try to log in, and a captive portal does not stop them. Two firewall rules fix it.
Router management reachable over IPv6 from the internet
Your IPv4 firewall may be fine, but the IPv6 input chain does not drop unsolicited traffic from the WAN side. Winbox, SSH and the other services listen on both, so they are exposed over IPv6 anyway.
RouterOS API without TLS is enabled
The plain RouterOS API on port 8728 is switched on by default, sends logins unencrypted and gives full control to whoever authenticates. Most routers never use it. Here is how to tell whether you do, and how to close it.
A scheduler script downloads and runs remote code
A scheduler entry or script on your router fetches a file from a remote server and then executes it or changes users and services. If you did not set this up yourself, it is the classic footprint of a MikroTik botnet.
SMB file sharing enabled on the router
Your MikroTik is running a Windows file-sharing service. The RouterOS SMB implementation has a record of remotely exploitable bugs, and a router has no business being a file server. Turning it off takes one command.
SNMP community with write access
An SNMP community with write access lets anyone who knows the community string change the router's configuration, and with SNMP v1 or v2c that string travels across the network in cleartext. Almost no monitoring setup needs this; here is how to remove it.
SNMP still uses the default community "public"
The community string is the password for SNMP, and "public" is the one every scanner tries first. Anyone who can reach UDP port 161 can read your interfaces, addresses, ARP table and traffic counters. Here is how to replace it and lock it down.
SNMP reachable from the internet without an address restriction
SNMP tells a monitoring server everything about your router — interfaces, addresses, neighbours, traffic. Without an address restriction it tells the same to anyone on the internet, and it is a favourite amplifier for DDoS attacks. Two settings close it.
SOCKS proxy enabled on a MikroTik: the classic sign of a hacked router
Almost nobody turns on the RouterOS SOCKS proxy on purpose. Botnets do, to relay their traffic through your router. If you did not enable it yourself, treat the device as compromised and rebuild it rather than just switching the proxy off.
SSH accepts sessions with no encryption (allow-none-crypto)
Your router's SSH service will accept a client that asks for the "none" cipher, so a badly configured tool could send passwords and commands in clear text. The setting is a leftover from old RouterOS versions and nothing needs it.
SSH port forwarding (tunnelling) is enabled
With SSH forwarding enabled, anyone who can log in to the router over SSH can tunnel arbitrary traffic through it and reach networks the firewall would otherwise keep them out of. Few setups need it; here is how to turn it off and what to use instead.
SSH reachable from the whole internet
SSH is encrypted and generally well built, but a login prompt that the whole internet can see draws non-stop password guessing. Restrict the service to your management addresses, or reach it through a VPN, and keep it as your reliable back door.
SSH strong-crypto is not enabled
By default the RouterOS SSH server still accepts legacy algorithms such as SHA-1, small Diffie-Hellman groups and CBC ciphers. Setting strong-crypto=yes limits it to modern ones. Here is what changes and what might stop connecting.
Your SSID contains a name, phone number or e-mail
A WiFi network name is broadcast to everyone in range and collected by public mapping databases. When it contains a surname, a phone number or an e-mail address, it ties a person to a physical location. A neutral name is a quick fix.
Telnet is enabled: your admin password travels in plain text
Telnet gives full command-line access to your router and sends the login and every keystroke unencrypted. There is no reason to keep it on a modern RouterOS device. One command switches it off; SSH does everything Telnet did, safely.
UPnP is enabled: any device in your LAN can open ports from the internet
UPnP lets any program on your network ask the router to forward a port from the internet, and the router obeys without asking you. Convenient for games and consoles, but malware uses the same mechanism. Here is what it means and how to turn it off safely.
Weak IPsec pre-shared key
The pre-shared key that protects your IPsec or L2TP/IPsec VPN is short, a dictionary word or otherwise easy to guess. With a captured handshake an attacker can test keys offline, and a guessed key lets them sit in the middle of every VPN session.
Weak password on an outgoing VPN connection
Your router dials into a remote VPN server with a password that is short or easy to guess. Anyone who works it out can connect to that server as if they were your router. Replace it with a long random one on both ends.
Weak passwords on VPN / PPP accounts
PPP secrets are the logins to your own VPN server. A short, guessable password on any of them gives a stranger a seat inside your network, past the firewall. Here is how to find the weak ones and replace them with passwords that hold.
Weak WiFi password: one captured handshake is all it takes
A WPA2 password does not need to be guessed live. An attacker records one handshake from the car park, takes it home and tests millions of candidates per second. Short, common or predictable passphrases fall within hours. Here is how to pick one that does not.
Web proxy enabled: when your router becomes an open proxy
The RouterOS web proxy is almost never needed today, but malware routinely switches it on to relay traffic or inject content. If it is reachable from the internet your router is an open proxy. Check who enabled it, then turn it off.
WebFig over plain HTTP: the web interface sends your login in cleartext
The www service serves WebFig over unencrypted HTTP, so your admin login can be read on the way. WebFig has also been the way in for several RouterOS exploits. Disable it, or switch to HTTPS with a certificate and an address restriction.
WebFig over HTTPS reachable from the whole internet
WebFig on port 443 is encrypted, which is the right choice, but nothing limits who can open the login page. An internet-facing web login on a router invites password guessing and puts you one browser-side bug away from a takeover.
WiFi channel not allowed for your country or installation type
One of your access points is fixed to a channel that is not permitted where the router operates — forbidden outright, limited to indoor use, or requiring radar detection. Letting the radio pick a channel under the correct country setting is usually the fix.
WiFi country is set to a different country than where the device operates
The country setting tells the radio which channels and power levels are legal. When it names a different country from the one the router is in, the radio may transmit where it must not — which is illegal and can interfere with weather radar.
WiFi country is not set
A wireless interface on your router has no country configured, so the radio uses generic power and channel limits instead of the ones that apply where it is installed. That can mean transmitting outside local rules, or missing channels you may use.
WiFi still allows WPA1 / TKIP
A security profile on your access point still allows WPA1 or the TKIP cipher. Both are cryptographically broken, and TKIP also caps the network at legacy speeds. Allow WPA2 with AES and WPA3 only.
WiFi radio in "superchannel" mode: regulatory limits switched off
A wireless interface is set to frequency-mode=superchannel, which lets the radio use any frequency and power the hardware supports regardless of your country's rules. Outside a licensed or lab setting this is not legal operation.
Winbox reachable from the internet: why it is the most attacked RouterOS service
Winbox is the tool you use to manage your MikroTik. When it is reachable from the internet, it is also the tool everybody else can use to try. Here is what the finding means and how to close it in two commands.
WPS is enabled on your WiFi
WiFi Protected Setup lets a device join your network by pressing a button on the router instead of entering the passphrase. Anyone with a moment of physical access can do the same. Disable it unless you actively use it.
www-ssl is enabled without a certificate
The HTTPS web interface is enabled on your router, but no certificate is assigned to it. Without one, browsers cannot verify the router, and the service does not provide a properly authenticated encrypted session. Three commands fix it.
New article every other day · RSS