Weak password on an outgoing VPN connection

What the audit found

A VPN client interface on your router — L2TP, PPTP, SSTP or OpenVPN — logs in to a remote server with a weak password. The report names the interface and shows the password in masked form together with the reason it was judged weak: too short, a dictionary word or name, digits only, or matching the user name.

The audit rates this medium. The router is not exposing anything here; the risk is to the remote server and to the tunnel. Passwords are only checked when the export was made with sensitive values shown.

Why it matters

An outgoing VPN connection is usually the link from a branch, shop or home to a central network, or to a provider's service. The user name and password on that connection are a valid account on the remote VPN server. Whoever knows them can connect to that server from anywhere, take your router's place, and reach whatever the tunnel is allowed to reach on the far side — head-office file servers, a central database, the management network of a fleet of routers.

Weak passwords fall in two ways. The remote server is on the internet, so it receives the same automated password guessing as any VPN endpoint; a short or common password is found in minutes to hours. And with some protocols the login exchange itself can be captured: PPTP's MS-CHAPv2 can be cracked outright, and L2TP without IPsec sends the authentication in a form that an offline dictionary attack breaks quickly. The password on a router is also written into the configuration, where it appears in every export and backup that gets emailed or saved to a shared drive.

Site-to-site credentials are rarely rotated and rarely reviewed, because "it just works". That makes them a durable, quiet way into a network.

What it looks like in Winbox

Open PPP → Interface. Client tunnels appear as L2TP Client, PPTP Client, SSTP Client or OVPN Client. Double-click the interface named in the report: the Dial Out tab shows Connect To, User and Password (dots unless Show passwords is ticked).

In an export, the password appears only when the export was made with sensitive values shown, which is also what the audit needs.

How to fix it

Generate a new random password. A passphrase of four or five unrelated words, or sixteen or more random characters from a password manager, is fine; the router does not mind typing it. Do not derive the new password from the old one and do not reuse a password from another system.

The password has to change on both ends. First set it on the remote server — under PPP → Secrets if the server is a MikroTik, or in the provider's portal — then on this router, in the Password field on the Dial Out tab of the client interface under PPP → Interface. The tunnel will drop and reconnect with the new credentials. If the tunnel carries your own management traffic to the remote site, make the change with Safe Mode on, or from a connection that does not depend on the tunnel, so that a typo does not leave you cut off.

While you are here, check the protocol. If the client is PPTP, or L2TP without IPsec, the audit reports that separately; a strong password does not fix a broken transport. WireGuard on RouterOS 7 replaces passwords with keys entirely and is the better long-term answer for router-to-router links.

Afterwards, watch the interface under PPP → Interface: its status should return to connected after the change, and a ping to a host on the far side of the tunnel should succeed. Then re-run the audit with a fresh export that includes sensitive values; the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

The remote server belongs to my ISP or a VPN provider. Can I change the password?

Usually yes, through their customer portal or by asking support. If they issued a short password and will not let you change it, ask whether they support certificate or key-based authentication instead; otherwise, at least be aware that the account is only as safe as their choice.

Why does the audit care about a client password? The router is not the one being attacked.

Because the account is a door into the network on the other end, and often that network is yours too — the head office, or a central management VPN. A guessed client password lets a stranger join that network as one of your sites.

I use the same password on several branch routers. Is that a problem?

Yes. If one branch export or backup leaks, every branch is compromised at once. Give each router its own account and password on the server so that one can be revoked without touching the rest.