🔒 KNOWLEDGE BASE

MikroTik security findings, explained

Every finding the audit can report has its own page: what it means, why it matters, what it looks like in Winbox, and the exact RouterOS commands that fix it. Written for people who run a MikroTik router, not only for security specialists.

Check your own configuration — free

Info SYS002 System

Default system identity "MikroTik"

Your router still carries the factory name "MikroTik". This is not a security hole, but a unique identity keeps logs, backups, neighbour lists and monitoring unambiguous, and it stops the device advertising that the rest of its setup may be default too.

Info EXP001 System

Your export contains passwords in readable form

The configuration file you uploaded includes WiFi keys, VPN secrets or similar credentials in plain text. That is normal for an export made with show-sensitive, and it let the audit check them — but the file itself now needs handling with care.

Info LOG001 System

Logs are kept only on the router

RouterOS keeps its log in memory. It is gone after a reboot, and anyone who takes over the router can erase it. Sending a copy to a syslog server is the difference between knowing what happened and guessing.

Info NTP001 System

NTP time synchronisation is not configured

Your router does not synchronise its clock. Most MikroTik devices have no battery-backed clock, so after every reboot the time starts from a fixed date. Certificates then fail to validate and logs become useless for working out what happened when.

High SYS001 System

Outdated RouterOS version with known vulnerabilities

Your router runs a RouterOS release that is behind current and has published security fixes it does not contain. This article explains what the version finding covers, why old MikroTik firmware gets exploited so reliably, and how to upgrade safely.

Medium UPNP001 System

UPnP is enabled: any device in your LAN can open ports from the internet

UPnP lets any program on your network ask the router to forward a port from the internet, and the router obeys without asking you. Convenient for games and consoles, but malware uses the same mechanism. Here is what it means and how to turn it off safely.

New article every other day · RSS