MikroTik security findings, explained
Every finding the audit can report has its own page: what it means, why it matters, what it looks like in Winbox, and the exact RouterOS commands that fix it. Written for people who run a MikroTik router, not only for security specialists.
The default "admin" account is still in use
Every brute-force attempt against a MikroTik starts with the user name "admin". Keeping that account active hands attackers half of the login for free. Create a personal full-access account with a different name and disable admin.
Full-access users can log in from any address
Accounts in the full group on your router have no address restriction, so a leaked password works from anywhere. Limiting admin logins to your management subnet adds a second barrier that costs nothing to maintain.
Hotspot users with trivial passwords
One or more accounts on your hotspot have passwords that are short, common or easy to guess. For a shared guest login that is usually fine; it becomes a problem when such an account has more rights than a visitor should.
Weak IPsec pre-shared key
The pre-shared key that protects your IPsec or L2TP/IPsec VPN is short, a dictionary word or otherwise easy to guess. With a captured handshake an attacker can test keys offline, and a guessed key lets them sit in the middle of every VPN session.
Weak password on an outgoing VPN connection
Your router dials into a remote VPN server with a password that is short or easy to guess. Anyone who works it out can connect to that server as if they were your router. Replace it with a long random one on both ends.
Weak passwords on VPN / PPP accounts
PPP secrets are the logins to your own VPN server. A short, guessable password on any of them gives a stranger a seat inside your network, past the firewall. Here is how to find the weak ones and replace them with passwords that hold.
Weak WiFi password: one captured handshake is all it takes
A WPA2 password does not need to be guessed live. An attacker records one handshake from the car park, takes it home and tests millions of candidates per second. Short, common or predictable passphrases fall within hours. Here is how to pick one that does not.
New article every other day · RSS