MikroTik RouterBOARD 411 (RB411)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Qualitative physical-susceptibility judgment, not attack prevalence: exposed RS232/miniPCI and boot menu with reset/NAND format require physical access. No malicious implant asserted.
Known vulnerabilities	Rare	🔗 Proof	Qualitative judgment: historical CVE-2018-14847 reads user database; affected stable 6.29-6.42, fixed 6.42.1. Patched builds not called vulnerable; no measured incidence.
Prior attacks	Rare	🔗 Proof	Talos 6 June 2018 Known Affected Devices explicitly lists RB411 for VPNFilter. Rare is qualitative, not measured frequency. Exact victim firmware/count not given; remote-attribution caveat applies.
Updatability	Very common	🔗 Proof	Historical cadence judgment: multiple official RouterOS6 stable releases in March-May2018. Update capability/cadence, not automatic patching or current hardware sales.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Partial capability judgment: SSH supports user/public-key and host-key authentication; documented BOOTP/DHCP/TFTP network boot lacks mandatory peer authentication. Not universal mutual auth.
Communications	No encryption	🔗 Proof	Assessed channel is historical HTTP WebFig management (www/80), NOT all traffic. 2018 service example has www-ssl disabled/no certificate. Configured HTTPS/SSH alternatives exist.
Storage	Encrypted with obselete encryption	🔗 Proof	Legacy flash credential file /flash/rw/store/user.dat uses reversible XOR with MD5(username plus hardcoded salt), shown in Tenable PoC. Obsolete protection of this element, NOT whole-flash encryption; later formats excluded.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Capability: named users/passwords, groups/policies, add/disable/delete accounts. Full refers to rubric lifecycle/less-privileged roles, not safe defaults or later complexity features.
Authentication	Basic	🔗 Proof	Qualitative Basic: normal user/password access, but physical RS232 boot recovery/reset has no account-authentication step. Not a claim all remote access is unauthenticated.
Brute-force protection	Exist	🔗 Proof	Configured capability only: administrator enables documented firewall/address-list SSH brute-force rules. NOT factory-default or universal WebFig/Winbox lockout. 2016 meeting material corroborates legacy capability.
Event logging	Access event logged	🔗 Proof	RouterOS account log records user/source/service login and logout. Documented shared platform capability, not an RB411 test or guaranteed persistent retention.
Passwords	Default/Common/Easy to guess	🔗 Proof	Exact original-board guide: admin/no password. Historical pre6.43 baseline only; not later forced-change/unique-password models. No default-change requirement invented.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Historical RouterOS 6.x before 6.43 (not current firmware) (Companion App: )
Hardware (CPU / GPU)	CPU: Atheros AR7130, 300 MHz • GPU:
Memory & Storage	Memory: 32 MB RAM • Storage: 64 MB NAND
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Documentation-only HISTORICAL assessment, not device test/current-firmware certification. Exact RB411 only. Rare/Very common are qualitative assessor judgments, no measured prevalence. HTTP management channel; legacy flash credential file; configured SSH firewall protection, not universal defaults. VPNFilter source does not pin victim firmware. Introduction date, not shipment: 4 December 2007. Legacy firewall corroboration: 2016 teaching. Shared platform evidence applies to RB411 RouterOS6 per exact-model discussion. Admin-only fields unset.