Automatic SMB sharing of attached storage is enabled

What the audit found

The Auto SMB Sharing setting under System → Disks → Settings is enabled on your router. When it is on, any storage device attached to the router — a USB flash drive, an SD card, an external disk — is automatically made available as a Windows-style file share over SMB, without any further configuration.

The audit reports this as low severity. On its own the setting shares nothing; it only matters once a drive is plugged in. It is reported because it turns a thoughtless action (inserting a stick to copy a backup) into an unintended network share.

Why it matters

This is a hygiene finding rather than an open hole, and it is worth keeping that in proportion.

The concern is what happens by accident. Somebody plugs a USB drive into the router to move a RouterOS package or fetch a backup file. With auto-sharing on, that drive immediately appears as an SMB share on every network the router's SMB service listens on. If the drive holds configuration backups — which on RouterOS contain user password hashes and, in older versions, secrets in readable form — those files are now browsable from the LAN, and from the internet if SMB is reachable there.

The second concern is the SMB service itself. RouterOS's SMB implementation has had serious bugs in the past, most notably CVE-2018-7445, a remotely exploitable memory-corruption flaw. A router is not a good file server, and every feature that encourages using it as one increases the chance the SMB service stays enabled and exposed. If the separate finding for an enabled SMB service is also in your report, deal with that one first.

If nothing is plugged in and SMB is disabled, this setting is dormant. The point of switching it off is that you will not have to remember it later.

What it looks like in Winbox

Open System → Disks and click Settings. The Auto SMB Sharing box is ticked; Auto Media Sharing (DLNA) may be as well. The main Disks list shows any attached storage and whether it is currently shared.

IP → SMB shows whether the SMB service itself is enabled and lists configured shares.

How to fix it

The fix is to untick both Auto SMB Sharing and Auto Media Sharing (DLNA) under System → Disks → Settings. Attached drives remain usable by the router itself — for backups, packages, or logging — but are no longer published to the network unless you create a share deliberately.

If you do not use the router as a file server at all, also disable the SMB service under IP → SMB, so there is nothing listening on port 445. If you genuinely want a share — a small office that keeps a few files on the router, say — create it explicitly under IP → SMB → Shares, give it a specific directory rather than the whole drive, create SMB users with passwords, and make sure the input firewall drops TCP 445 from the WAN side. A deliberate share you can describe is fine; an automatic one you did not know about is the problem.

None of this affects management access, so Safe Mode is not required. Afterwards, plug in a USB drive (or check an already attached one): it should not appear under IP → SMB → Shares, and browsing the router's address from a Windows PC should show nothing — or fail to connect if you disabled SMB entirely. Confirm that the disk settings show both auto-sharing options off, then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I use the router's USB drive as a shared folder for the office. Do I have to stop?

Not necessarily, but do it on purpose: define the share explicitly, use SMB users with passwords, restrict the share to the internal network and keep the service blocked from the WAN. Also keep RouterOS updated, since the SMB service is where the router's worst historical bugs lived. A small NAS is a better long-term home for shared files.

Does disabling this affect backups stored on the USB drive?

No. The drive stays mounted and the router can still read and write it. Only the network share disappears. Binary backups or exports written to the drive work exactly as before.

What is auto-media-sharing?

It publishes media files on attached storage via DLNA, so TVs and media players on the network can browse them. It has the same "everything plugged in becomes public" behaviour, which is why the fix disables both together.