Default system identity "MikroTik"

What the audit found

The system identity under System → Identity is either empty or still the factory value MikroTik. The identity is the router's name: it appears in the Winbox title bar, in the command prompt, in log messages sent to a syslog server, in neighbour discovery on the LAN, in backup file names and in the header of every export.

The audit rates this info. It is a hygiene item with no direct security impact. Changing it takes one command and helps in ways that have more to do with operating the router well than with defending it.

Why it matters

Being honest about scale: nobody has been compromised because their router was called MikroTik. The reasons to change it are practical.

Ambiguity. If you manage more than one device, a syslog server receiving messages from three routers all called MikroTik cannot tell them apart. Backups named MikroTik-20250101.backup from different sites look identical. Neighbour discovery in Winbox lists several MikroTik entries and you pick the wrong one. When something breaks at two in the morning, every one of these small confusions costs time, and restoring a backup to the wrong device is the kind of mistake a name would have prevented.

Signalling. A factory name is a mild tell. Anyone who sees MikroTik in a discovery broadcast, a login banner or a wireless neighbour list can reasonably guess that other things are also at their defaults — the admin account, the enabled services, perhaps the password. That guess is often right. A named router does not prove the opposite, but it removes an easy cue that automated tools and casual snoops use to pick targets.

Monitoring. Systems such as Zabbix, LibreNMS or The Dude use the identity (via SNMP sysName) to label the device. A meaningful name there means alerts say "core-office-01 is down" rather than "MikroTik is down".

What it looks like in Winbox

The identity is shown in the Winbox title bar after the address, for example admin@192.168.88.1 (MikroTik). Open System → Identity to see and edit the Identity field. It also appears in IP → Neighbors as seen from other MikroTik devices on the same segment, and at the top of every export as a comment line followed by the identity line.

How to fix it

The fix is to give the router a unique name in the Identity field under System → Identity — something that identifies the site and role, such as office-gw-01 or brno-shop-ap. A short, lower-case, hyphenated name works everywhere: it is safe in file names, in syslog, in SNMP and in DNS if you register the device there. Avoid spaces and special characters, and avoid putting anything sensitive in the name, since it is visible in neighbour discovery on every interface where discovery is enabled.

The change takes effect immediately, does not interrupt any connection, and cannot affect your management access, so Safe Mode is not needed. If your monitoring system polls sysName, it will pick up the new name on its next discovery run; some systems need the host renamed manually to match.

While you are here, it is worth opening IP → Neighbors → Discovery Settings and limiting the Interface list to your LAN interfaces, so that the new name — and the device model and version alongside it — are announced only where you want them. The audit reports discovery on the WAN side separately.

Afterwards, reconnect Winbox and check the title bar for the new name, and make sure the next backup or export you save carries it in its header. Then re-run the audit: the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Does the identity affect DNS, the hostname on the LAN, or the hotspot?

The identity is used for neighbour discovery, SNMP sysName, logging and the prompt. It is not automatically registered in DNS and is not what DHCP clients see as a domain. The hotspot's DNS name and the router's DNS entries are configured separately, so changing the identity will not break them.

I have dozens of routers. Is there a convention that works?

Pick a scheme and stick to it: <site>-<role>-<number>, such as prague-core-01 or warehouse-ap-03. The name should let someone who has never seen the network guess where the device is and what it does. Keep a list alongside your backups and use the same names in your monitoring system.

Is the audit treating this as a real vulnerability?

No. It is reported at the lowest level because it is worth doing, not because it is dangerous. It sits in the report alongside things like NTP configuration and remote logging: operational habits that make the router easier to manage and incidents easier to investigate.