🔒 KNOWLEDGE BASE

MikroTik security findings, explained

Every finding the audit can report has its own page: what it means, why it matters, what it looks like in Winbox, and the exact RouterOS commands that fix it. Written for people who run a MikroTik router, not only for security specialists.

Check your own configuration — free

Medium SVC007 Router services

API-SSL is enabled but nothing uses it

RouterOS enables the TLS API by default, and most routers never have an application talking to it. A management service that nothing uses is attack surface without a benefit. Disable it, or restrict it to the one address that needs it.

High SVC002 Router services

FTP is enabled: credentials and files travel unencrypted

The FTP service on your MikroTik is on, as it is in every factory configuration. It sends the router's admin password in plain text and is a favourite brute-force target. Disable it and use SFTP over SSH instead.

High SVC004 Router services

RouterOS API without TLS is enabled

The plain RouterOS API on port 8728 is switched on by default, sends logins unencrypted and gives full control to whoever authenticates. Most routers never use it. Here is how to tell whether you do, and how to close it.

Medium SVC008 Router services

SSH reachable from the whole internet

SSH is encrypted and generally well built, but a login prompt that the whole internet can see draws non-stop password guessing. Restrict the service to your management addresses, or reach it through a VPN, and keep it as your reliable back door.

Critical SVC001 Router services

Telnet is enabled: your admin password travels in plain text

Telnet gives full command-line access to your router and sends the login and every keystroke unencrypted. There is no reason to keep it on a modern RouterOS device. One command switches it off; SSH does everything Telnet did, safely.

High SVC003 Router services

WebFig over plain HTTP: the web interface sends your login in cleartext

The www service serves WebFig over unencrypted HTTP, so your admin login can be read on the way. WebFig has also been the way in for several RouterOS exploits. Disable it, or switch to HTTPS with a certificate and an address restriction.

Medium SVC009 Router services

WebFig over HTTPS reachable from the whole internet

WebFig on port 443 is encrypted, which is the right choice, but nothing limits who can open the login page. An internet-facing web login on a router invites password guessing and puts you one browser-side bug away from a takeover.

High SVC006 Router services

Winbox reachable from the internet: why it is the most attacked RouterOS service

Winbox is the tool you use to manage your MikroTik. When it is reachable from the internet, it is also the tool everybody else can use to try. Here is what the finding means and how to close it in two commands.

Low SVC010 Router services

www-ssl is enabled without a certificate

The HTTPS web interface is enabled on your router, but no certificate is assigned to it. Without one, browsers cannot verify the router, and the service does not provide a properly authenticated encrypted session. Three commands fix it.

New article every other day · RSS