WebFig over plain HTTP: the web interface sends your login in cleartext

What the audit found

The www service under IP → Services is enabled. This is the plain-HTTP version of WebFig, the browser-based management interface, normally on TCP port 80. Anything you do in it — including logging in — is sent without encryption.

The audit rates this high when the service is reachable from the internet, medium when reachable from selected external addresses, and low when only the internal network can reach it. The HTTPS variant (www-ssl) is a separate service and is not what this finding is about.

Why it matters

There are two reasons to care, and they matter at different scales.

The first is the login itself. Over HTTP, your user name and password travel in readable form between the browser and the router. On a LAN that you fully control this is a modest risk; on a shared or guest network, over an ISP link, or anywhere someone could be recording traffic, it hands over full control of the router to whoever is watching. Once an attacker has the admin password, every other setting on the device is theirs.

The second is the web server's track record. WebFig has been the entry point for several RouterOS vulnerabilities over the years — the wave of compromises that followed CVE-2018-14847 was largely delivered through routers whose web or Winbox interface faced the internet, and later botnets (Mēris in 2021 among them) kept harvesting devices that were never patched. A management web server that anyone can reach means that the next bug of that kind is immediately usable against you, even if your password is strong.

If the service is only reachable from your LAN, treat this as a hygiene item: switch to HTTPS when convenient. If it faces the internet, treat it as urgent.

What it looks like in Winbox

Open IP → Services. Find the row www. If it is not greyed out, plain-HTTP WebFig is enabled; Port is usually 80 and Available From is often empty. Directly below it, the www-ssl row is the encrypted alternative, which on many routers is disabled by default.

How to fix it

If you manage the router with Winbox or SSH and never use the browser interface, simply disable the www service under IP → Services. Nothing else depends on it.

If you do want WebFig, move it to the HTTPS service instead. The principle has three parts. First, the router needs a certificate: RouterOS can create and self-sign one for you under System → Certificates — a self-signed certificate is fine for a management interface, your browser will warn once and you can accept it. Second, enable the www-ssl service with that certificate selected and its Available From field set to your management network; you can list several subnets there. Third, disable the plain-HTTP www service so the unencrypted door is closed for good.

The address restriction matters as much as the encryption. It tells the router to refuse browser connections from anywhere except the networks you list, regardless of what the firewall does. If you need WebFig from outside, use a VPN whose subnet is included in that list.

Because you are changing the web service, not Winbox or SSH, this cannot lock you out of those. Still, if the browser is your only way in, make the change with Safe Mode on and test the HTTPS login before closing the HTTP session. Afterwards, open the router's address over plain HTTP — it should not connect — and over HTTPS from your management network, where WebFig should load; from outside (a phone on mobile data) neither should answer. Then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

The browser warns that the certificate is not trusted. Is that a problem?

Not for a self-signed certificate you created yourself. The warning means the browser cannot verify who issued it, not that the connection is unencrypted. Accept it once for your router's address, or import the certificate into your browser to silence it. What matters is that the login now travels encrypted.

I use WebFig from my phone when I am away. What should I do?

Do not publish the web interface to the internet for that. Set up a VPN to the router (WireGuard on RouterOS 7 is quick to configure), include the VPN subnet in the Available From field of www-ssl, and open WebFig through the tunnel.

Is moving www to another port an acceptable fix?

No. The login is still unencrypted and scanners identify a web server by its response, not its port. Disable www or switch to www-ssl with an address restriction.