WPS is enabled on your WiFi

What the audit found

An enabled WiFi interface on your router has WPS (WiFi Protected Setup) left on. WPS is a convenience feature: instead of typing the WPA2 passphrase into a new device, you press a button on the access point and the device is handed the key. RouterOS supports the push-button method; the setting is WPS Mode on the wireless interface, and unless it is set to disabled the feature is available.

The audit reports this as low. It is a small reduction in control over who joins the network, not a remote vulnerability.

Why it matters

The push-button method has a simple limitation: the router cannot tell who pressed the button. For a couple of minutes after the press, any device in range that asks for the key gets it. That is fine in a home where the router sits in a cupboard and only the family can reach it. It is less fine in a shop, a shared office, a waiting room or a rack cabinet where people you do not know pass by. A visitor with a phone needs a few seconds alone with the device to join a network they were never given the passphrase for — and once joined, their device holds the key permanently.

There is also the historical baggage. The WPS PIN method, which RouterOS does not implement, was shown in 2011 to be brute-forceable in a few hours and led to WPS being disabled by default on most equipment since. Push-button mode does not share that flaw, but the feature as a whole has a reputation for good reason, and network audits routinely flag it.

In short: WPS trades a small amount of security for the convenience of not typing a passphrase. If you never use that convenience, there is no reason to keep the trade.

What it looks like in Winbox

Open Wireless → WiFi Interfaces (or Wireless → Interfaces on older versions) and double-click your access point interface. On the Wireless tab, scroll to WPS Mode. If it shows push-button or push-button-virtual-only, WPS is active; disabled means it is off. There is also a WPS Accept button in the interface window, which is the software equivalent of the physical button. RouterOS 7 devices with the newer WiFi driver do not offer WPS at all.

How to fix it

The fix is to set WPS Mode to disabled on every wireless interface, in the interface's own settings under Wireless → WiFi Interfaces. Check each physical radio and each virtual AP separately; the setting belongs to the interface, not to the security profile, so it is not inherited. Once it is off, the router will no longer hand out the key to anyone who presses the button — the only way onto the network is knowing the passphrase.

The setting takes effect immediately and does not disconnect existing clients, because it only affects how new devices are allowed to obtain the key. There is no risk of locking yourself out, so Safe Mode is not needed.

If you do use WPS to onboard devices — some printers and IoT gadgets make it the only comfortable way — leave it enabled only on the interface those devices use, and keep the router physically out of reach of strangers. The push-button-virtual-only mode is a useful middle ground: it restricts WPS to the software button in Winbox, which cannot be triggered by touching the device, so a passer-by gains nothing.

While you are in the interface settings, confirm that the security profile uses WPA2 with AES (see the separate finding for WPA1/TKIP). WPS hands out whatever key the profile uses, so the profile should be strong regardless. Afterwards, the interface details should show WPS disabled on every radio, and on a phone the connection dialogue for your network should no longer offer a WPS option; existing clients stay connected. Re-run the audit; the finding disappears.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I use WPS to connect my printer. Is there another way?

Yes — type the passphrase into the printer's own WiFi setup, which every printer supports even if it is slower. Alternatively, enable WPS just for the minutes you need it, press the button, and disable it again afterwards. The finding is about leaving it permanently available.

The router is in a locked cabinet. Does this still matter?

Much less. The risk of the push-button method is entirely about physical access. If nobody untrusted can reach the device, WPS is close to harmless, and the audit rates it low for that reason. Disabling it is still the tidier choice, because it removes a way for the key to leave the router without anyone typing it.

Is push-button WPS as bad as the PIN method?

No. The PIN weakness that made WPS notorious does not apply to push-button mode, and RouterOS does not implement PINs. Push-button mode only exposes the key during the window after a press, to whoever is in range at that moment.