WiFi still allows WPA1 / TKIP

What the audit found

A WiFi network on your router is configured with a security profile that permits WPA1 (wpa-psk or wpa-eap in the authentication types) or the TKIP cipher, either as the only option or alongside WPA2. Both date from 2003, were designed as a stop-gap for hardware that could not do AES, and have been considered broken for well over a decade.

The audit reports this as high for any enabled access point whose profile allows these options, because the weakness is in the encryption of the wireless link itself and does not depend on firewall settings.

Why it matters

WPA1 with TKIP was a patch for WEP. It reuses WEP's underlying RC4 cipher with a key-mixing scheme layered on top, and by 2008 researchers had shown practical attacks that decrypt individual packets and inject forged ones. Later work reduced the effort further. A nearby attacker with a laptop can recover traffic and, in some setups, join the network.

The subtler problem is the "mixed mode" many people run to keep an old printer or an early smartphone working: the profile allows both WPA2/AES and WPA1/TKIP, and each client picks what it supports. That does not protect the modern clients as much as it seems. The group key used for broadcast and multicast traffic is negotiated at the weakest level any client requires, so with one TKIP client on the network, everybody's broadcast traffic uses TKIP. Attacks on the group key affect the whole network.

There is also a practical cost. The 802.11n and later standards forbid high-throughput rates with TKIP, so a network that allows it is forced down to 54 Mbit/s for those sessions. Removing TKIP is one of the few security changes that makes things faster.

What it looks like in Winbox

Open Wireless → Security Profiles and double-click the profile used by your access point (the Security Profile field on the interface's Wireless tab tells you which one). On the General tab, look at Authentication Types: if WPA PSK or WPA EAP is ticked, WPA1 is allowed. Look at Unicast Ciphers and Group Ciphers: if tkip is ticked, the weak cipher is allowed. RouterOS 7 devices using the newer WiFi driver show this under WiFi → Security instead.

How to fix it

The fix is to narrow the security profile to WPA2 with AES only. In the profile under Wireless → Security Profiles, that means the mode set to dynamic keys, Authentication Types reduced to WPA2 PSK alone (untick the WPA PSK and WPA EAP boxes), and both Unicast Ciphers and Group Ciphers reduced to AES-CCM with tkip unticked. Every profile in use on an enabled access point needs the same treatment; a virtual AP with its own profile is easy to miss.

Take the opportunity to replace the passphrase with a strong new one. It may have been exposed over the weak link, and a rotation costs only a round of reconnecting devices.

On RouterOS 7 with the newer WiFi driver, the equivalent is a security profile whose authentication types allow WPA2 PSK together with WPA3 PSK and whose encryption is CCMP. Adding WPA3 alongside WPA2 lets capable clients use it while older ones keep working, and it is the recommended target there.

Wireless changes take effect immediately and reconnect all clients. If you are administering the router over WiFi, expect to lose the session briefly; Safe Mode is not strictly necessary because a wrong passphrase is fixable from a wired port, but keep a cable within reach. Afterwards, connect a phone or laptop and check the security shown in its WiFi details — it should read WPA2 or WPA3, never WPA/WPA2 mixed — and confirm in Wireless → Registration that every client shows a WPA2 authentication type and AES-CCM encryption. Then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I have an old device that only supports WPA/TKIP. What do I do?

Do not weaken the main network for it. If the device is worth keeping, give it its own SSID on a separate virtual AP with its own security profile, put that network in an isolated VLAN with no access to your LAN, and treat it as untrusted. In most cases, though, a device that cannot do WPA2 is fifteen or more years old and can be retired.

Will removing TKIP disconnect current clients?

Yes, briefly. Every client reconnects when the profile changes. Any device that genuinely cannot do WPA2/AES will fail to rejoin — that is the point. If you rotated the passphrase at the same time, clients will need the new one.

Should I go straight to WPA3?

WPA3-only is not yet practical for most networks because some printers, IoT devices and older laptops do not support it. The recommended setting is WPA2 and WPA3 together with AES-CCM, which is what the RouterOS 7 WiFi driver supports. On the legacy wireless driver, WPA2-PSK with AES is the correct target.