A scheduler script downloads and runs remote code

What the audit found

An active entry under System → Scheduler or System → Scripts fetches a file from another server and then imports it, runs it as a script, or changes user accounts or services. In other words, the router periodically asks an outside machine what to do next and does it.

The audit reports this as high when the download comes from an address on the internet. When the source is a server in a private network it is reported as medium, because that arrangement is common in ISP provisioning — but it still deserves a look, since the download is usually unauthenticated.

Why it matters

This is precisely how compromised MikroTik routers are kept under control. After the 2018 Winbox vulnerability (CVE-2018-14847) and again during the Mēris botnet campaign of 2021, the attackers' first move on each device was to add a scheduler entry that fetched a script from their server every few minutes and ran it. That let them change passwords, enable proxies, alter DNS, or update their tooling long after the original hole was patched. Rebooting or upgrading the router does not remove a scheduler entry.

If you did not create the entry yourself, assume the router is compromised. Everything it has had access to — passwords, VPN secrets, traffic that passed through it — may be known to someone else.

If you did create it, for example as a home-made provisioning or backup mechanism, the concern is different but real. HTTP, FTP and TFTP downloads carry no proof of who sent the file. Anyone who can impersonate or compromise the server you fetch from, or intercept the connection, gets to run arbitrary commands on your router with full rights. That is a lot of trust to place in a plain download.

What it looks like in Winbox

Open System → Scheduler. Each row shows a name, an interval and the On Event code; suspicious entries often have short intervals (a few minutes) and innocuous names. Double-click a row to read the full script. Then open System → Scripts and check each script's Source for a fetch followed by an import, a script run, or a user being added. Reading the detailed listing of both windows side by side is the quickest way to see everything at once. Also glance at Files for scripts you do not recognise.

How to fix it

Start by reading everything under System → Scheduler and System → Scripts in detail, and decide for each entry whether you can explain it. The right fix depends entirely on that answer.

If you do not recognise an entry, treat the router as compromised. Removing the entry alone is not enough, because you cannot know what else was changed. Back up the configuration for reference, reinstall RouterOS with Netinstall (which wipes the storage), upgrade to a current version, restore only the parts of the configuration you understand, change every password on the device and on any account reachable through it, and make sure management is no longer exposed to the internet — that is how it got in.

If the entry is your own provisioning, keep the mechanism but secure it. Serve the file over HTTPS and make the fetch verify the server's certificate (the check-certificate option), after importing the CA certificate under System → Certificates. Prefer pulling a file and reviewing it to executing whatever arrives, and restrict the fetch in the firewall to the one server address it should ever talk to.

Neither path touches your management access, so Safe Mode is not strictly needed, but keep a second way in while you clean up. Afterwards, the Scheduler and Scripts windows should list only entries you can explain; also check System → Users for accounts you did not create, the SOCKS and web proxy settings for services you did not enable, and IP → DNS for unexpected servers. Then re-run the audit — the finding disappears once no active entry downloads and runs remote code.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

The script is from my ISP. Should I remove it?

Ask them first. Managed routers are often provisioned this way and removing the entry may break support or updates. But do ask whether the download is authenticated (HTTPS with certificate checking) and whether the provisioning server is reachable only from their management network. A plain HTTP fetch that imports whatever it receives is a risk on their side as much as yours.

I only use fetch to download a backup script I wrote. Is that really a problem?

The risk is not the fetch, it is executing the result blindly. If the file is served over plain HTTP, anyone in the path can replace it. Move the file to HTTPS with certificate checking on, or copy the script onto the router once and run it locally rather than downloading it each time.

How do I know whether the router was actually compromised?

You often cannot tell from the configuration alone; attackers tidy up. Signs include accounts you did not create, changed DNS servers, an enabled SOCKS or web proxy, unexplained files, and traffic to unknown addresses in Torch. If any of these are present, or if the scheduler entry is unexplained, reinstalling is the only way to be sure.