RouterOS API without TLS is enabled

What the audit found

The api service is enabled under IP → Services. This is the plain, unencrypted version of the RouterOS API on TCP port 8728; it is switched on in the factory configuration, so most routers have it running whether or not anything uses it.

The audit rates this high when the port is reachable from the internet, medium when it is limited to selected external addresses, and low when it can only be reached from the internal network. An encrypted alternative, api-ssl on port 8729, exists for applications that genuinely need programmatic access.

Why it matters

The API is a full management channel: anyone who logs in over it can read and change the whole configuration, add users, or reboot the device. That makes it as sensitive as Winbox or SSH — but without the encryption that SSH provides.

Two things follow. First, the login itself crosses the network in a form that can be read by anyone able to capture the traffic. Over the internet that includes any compromised network between you and the router; on a LAN it includes anyone on the same segment. If a script or monitoring tool logs in over the plain API, its password is exposed every time it runs.

Second, the API is a well-known brute-force target. Scanners test port 8728 specifically because it is open on so many MikroTik devices, and a login attempt costs the attacker almost nothing. A weak or reused password on any account will be found. Because the service is on by default and rarely used, it is exactly the kind of door that nobody watches: the router logs the attempts, but few people read those logs.

If nothing on your network talks to the API, the service is pure attack surface with no benefit.

What it looks like in Winbox

Open IP → Services. Look for the row api (port 8728). If it is not greyed out, the service is enabled; if Available From is empty, any address may connect. The row api-ssl (port 8729) is the encrypted variant.

You can also check Log for repeated login failure entries mentioning via api — a sign that someone is already trying passwords against it.

How to fix it

If you do not know of any application that uses the API, the fix is simply to disable the api row under IP → Services. Nothing else on the router depends on it — Winbox, WebFig and SSH keep working — so this is a safe change that cannot affect your own management session and does not need Safe Mode.

If an application does need programmatic access — a billing system, a monitoring tool, a home-automation controller — the principle is to move it to the encrypted service and to restrict who may reach it. That means disabling the plain api row, enabling api-ssl instead, and filling its Available From field with the network the application runs on, so that no other address can even open a connection. The encrypted service needs a certificate to be useful, assigned in the Certificate field of the same dialog; most API libraries then connect over TLS by changing the port to 8729 and switching on their TLS option.

Whatever you choose, also make sure the input chain of your firewall drops unsolicited traffic arriving on the WAN interface, so that neither port is reachable from the internet in the first place — the audit reports a missing WAN drop separately.

Afterwards, attempt a TCP connection to port 8728 on your public address from outside your network; it should be refused or time out. If you moved to api-ssl, confirm your application still connects on port 8729. Then re-run the audit: the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

How do I know whether something uses the API?

Look at Log for logged in via api entries; filtering the log window for the word "api" narrows it down quickly. Anything that logs in regularly will show up with its source address. If the log shows nothing for a few days, you can disable the service with confidence — and re-enable it if something breaks.

Is restricting the address enough, without disabling it?

It helps, and it is the right step if you must keep the plain API on a LAN. But the credentials still travel unencrypted, so anyone on that LAN segment could capture them. Prefer api-ssl with an address restriction; it costs nothing more than a certificate.

Does RouterOS itself use the API for anything?

No. Winbox, WebFig, the console and The Dude use their own channels. The API exists purely for third-party software. Disabling it has no effect on the router's own functions.