SMB file sharing enabled on the router

What the audit found

The SMB service under IP → SMB is enabled. SMB is the Windows file-sharing protocol; on a MikroTik it lets the router share its internal storage or an attached USB disk as a network drive on TCP port 445.

The audit rates this critical when the port is reachable from the internet and medium when it is only reachable from the internal network. Either way the recommendation is the same: unless you deliberately use the router as a small file share, the service should be off.

Why it matters

SMB is a large, complex protocol, and the implementation inside RouterOS has had serious bugs. The best known is CVE-2018-7445, a buffer overflow in the SMB service that could be triggered before any login, giving an attacker code execution on the router. More recent RouterOS 7 releases have fixed further memory-corruption issues in the same service. Bugs of this class are the worst kind: no password is needed, and a single crafted packet can be enough.

Picture the scenario. The router sits on a public address with SMB reachable. A scanner — the same kind that hunts for exposed Windows shares — notices port 445 open and identifies a MikroTik. If the firmware is not fully patched, the attacker is in with root-level control of the device that every packet of yours passes through. If it is patched, they still have an unauthenticated service to probe for the next bug.

Even on a LAN the exposure is unusual: any compromised laptop or infected phone on the network can reach the service, and an attacker who lands on one workstation gains a second path to the router that does not go through Winbox or SSH.

Set against that, the benefit is small. Sharing a USB stick from the router is convenient occasionally, but a NAS or a workstation does the job better and keeps the file-server attack surface off the device that protects your network.

What it looks like in Winbox

Open IP → SMB. The Enabled checkbox will be ticked, and you will see the share settings (Domain, Comment, Allow Guests). The Shares tab lists what is shared — often the built-in pub share pointing at the router's flash storage.

Also check Disk → Settings (RouterOS 7) for Auto SMB Sharing, which shares any attached storage automatically.

How to fix it

The fix is to switch the service off: untick Enabled under IP → SMB, and on RouterOS 7 also make sure Auto SMB Sharing under Disk → Settings is off, so that plugging in a USB disk does not quietly bring the share back. That is the whole change. It stops the SMB service immediately and closes port 445 on the router. No other RouterOS function depends on SMB, so Safe Mode is not needed — nothing about this change can affect your own management access.

If you were using the share for something specific (a scripts folder, a place to drop firmware files), use SFTP over the SSH service instead: any SFTP client can read and write the router's file store with the same credentials, and the connection is encrypted. The Files window in Winbox also supports drag-and-drop upload and download. FTP is available too but sends passwords in the clear, so prefer SFTP.

If you genuinely want the router to serve files on a trusted LAN, the principle is to shrink the exposure rather than remove it: make sure the input chain of the firewall drops traffic arriving on the WAN interface, keep RouterOS fully updated, and untick Allow Guests so that a login is required. The audit will still mention the service, but at a lower severity.

Afterwards, try to open the router's share from a Windows machine on the LAN; it should fail to connect, and from outside a TCP connection to port 445 on your public address should time out. Then re-run the audit: the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I share a USB disk from the router for the office. What should I use instead?

A small NAS, a Raspberry Pi with Samba, or a share on an existing workstation or server. Any of them is a proper file server with access control and, importantly, is not the device that sits between your network and the internet. If the router must keep the role, restrict it to the LAN and keep it patched.

My firewall already blocks port 445 from the internet. Is that enough?

It reduces the finding to medium, but the service is still reachable from every device on your LAN, including any that get infected. Since nothing else on the router uses SMB, disabling it costs you nothing and removes the exposure entirely.

Does disabling SMB affect the router's file list or backups?

No. Files in Winbox, backups, exports and script storage all live in the router's file system independently of SMB. You can still upload and download files by dragging them into the Winbox Files window or over SFTP.