MikroTik security findings, explained
Every finding the audit can report has its own page: what it means, why it matters, what it looks like in Winbox, and the exact RouterOS commands that fix it. Written for people who run a MikroTik router, not only for security specialists.
Automatic SMB sharing of attached storage is enabled
With auto-sharing on, any USB stick or SD card plugged into the router is published over SMB the moment it is inserted. That is convenient until somebody plugs in the wrong drive. Disable it unless the router is deliberately used as a file share.
Bandwidth-test server reachable from the internet
The RouterOS bandwidth-test server is on by default and answers on TCP port 2000. When the internet can reach it, anyone with a router login can saturate your uplink, and it is one more place to guess passwords.
MAC-Telnet and MAC-Winbox available on all interfaces, including WAN
MAC-Telnet and MAC-Winbox let you manage a router by its hardware address instead of an IP address. When they are allowed on the WAN port, everyone in the ISP segment can try to log in, and the IP firewall cannot stop them.
MikroTik Cloud DDNS is enabled: convenient, and easy to find
With Cloud DDNS on, your router publishes its public address under a name that is derived from its serial number. That is handy for VPNs and harmless in itself, but it makes the device easy to locate, so management must not be reachable from the internet.
Neighbour discovery (MNDP/CDP/LLDP) active on the WAN side
Neighbour discovery announces your router's model, RouterOS version, identity and addresses to every device on the same segment. On the WAN port that audience is your ISP and its other customers. Limit it to the LAN.
RoMON is enabled without a secret
RoMON lets you manage MikroTik devices through each other at layer 2, even without IP addresses. Without a secret, any RoMON-capable device plugged into the same segment can join that management network. Set a secret or switch RoMON off.
SMB file sharing enabled on the router
Your MikroTik is running a Windows file-sharing service. The RouterOS SMB implementation has a record of remotely exploitable bugs, and a router has no business being a file server. Turning it off takes one command.
New article every other day · RSS