Default SSID "MikroTik": what a factory network name tells attackers

What the audit found

At least one wireless interface in your configuration still broadcasts a factory network name: MikroTik, MikroTik- followed by six characters from the MAC address, or a generic placeholder such as default or wireless. The audit reports this at info level. It is a hygiene item, not a security hole: nothing about the name itself lets anyone in.

Why it matters

A network name is the one thing about your router that anyone can read from the street, no password required. A default one says three things to a passer-by with a WiFi scanner.

First, the make of the device. Knowing it is a MikroTik tells an attacker which default credentials to try, which management ports to look for, and which known vulnerabilities apply — CVE-2018-14847 and the botnets that followed did a lot of their damage on devices whose owners never changed anything after unboxing.

Second, and more telling, that the owner probably did not finish setting the router up. A default SSID is a reasonable predictor of a default admin password, an unrestricted Winbox service, and the factory firewall — or none. Attackers who look for easy targets use exactly this kind of signal to decide where to spend their time.

Third, in the MikroTik-XXXXXX form, part of the device's MAC address, which can be useful when correlating the router with other things seen on the network.

None of this matters much if the rest of the configuration is sound. A strong WiFi password and a proper firewall protect you regardless of the name. But there is no reason to advertise, and the fix costs nothing.

What it looks like in Winbox

Open Wireless → WiFi Interfaces (on RouterOS 7 with the newer driver, WiFi). The SSID column shows the name each radio broadcasts. A default one reads MikroTik or MikroTik- with a hexadecimal suffix. Double-click an interface to change it on the Wireless tab.

How to fix it

Set a name of your own in the SSID field of each affected interface under Wireless → WiFi Interfaces (on RouterOS 7 with the wifi package, the SSID lives in the interface's configuration under WiFi). Choose something meaningful to you but not to a stranger: avoid the vendor name, the model, the words "default", "wireless" or "test", and anything that ties the network to a specific person or address — a privacy matter rather than a security one, but it costs nothing. Do not rely on hiding the SSID; a hidden network is revealed by every client that joins it and gains you nothing.

Every client will see the change as a new network and will need to reconnect, so do it at a quiet time and tell the users. If you have several radios, change each one deliberately rather than with a blanket change that might catch a guest network you meant to keep separate.

While you are in the interface settings, this is a good moment to confirm the security profile uses WPA2 or WPA3 with a strong pre-shared key; that is the setting that actually keeps people out. Changing the SSID affects only wireless clients, not your Winbox or SSH session over the wire, so Safe Mode is not needed — unless you are managing the router over the same WiFi.

Afterwards, scan for networks from a phone: the old name should be gone and the new one visible, and no interface in the list should still carry the factory SSID. Then re-run the audit; the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Isn't this a purely cosmetic finding?

Largely, yes, and the audit rates it accordingly. Think of it as the WiFi equivalent of leaving the "SET YOUR PASSWORD" sticker on the front door: it does not open the door, but it invites people to try the handle. It is also a prompt to check whether the other defaults were changed.

Does hiding the SSID achieve the same thing?

No. A hidden SSID still has to be sent by every device that connects, so any scanner sees it within seconds. Hiding the name causes connection problems for some clients and provides no protection. Rename it and leave it visible.

I have several access points. Should they all use the same name?

For one building, yes — clients roam between access points with the same SSID and security settings. The point of this finding is only that the shared name should be one you chose, not the factory one.