MikroTik RouterBOARD 750 (RB750)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Qualitative physical-susceptibility judgment, not prevalence: original RB750 has reset jumper under rubber foot and front button for recovery/network boot. Physical access required; no serial port.
Known vulnerabilities	Rare	🔗 Proof	Qualitative judgment: historical CVE-2018-14847 reads user database; affected stable 6.29-6.42, fixed 6.42.1. Patched builds not called vulnerable; no measured incidence.
Prior attacks	Rare	🔗 Proof	Talos 6 June 2018 Known Affected Devices explicitly lists RB750 for VPNFilter. Rare is qualitative, not measured frequency. Exact victim firmware/count not given; remote-attribution caveat applies.
Updatability	Very common	🔗 Proof	Historical cadence judgment: multiple official RouterOS6 stable releases in March-May2018. Update capability/cadence, not automatic patching or current hardware sales.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Partial capability judgment: SSH supports user/public-key and host-key authentication; documented BOOTP/DHCP/TFTP network boot lacks mandatory peer authentication. Not universal mutual auth.
Communications	No encryption	🔗 Proof	Assessed channel is historical HTTP WebFig management (www/80), NOT all traffic. 2018 service example has www-ssl disabled/no certificate. Configured HTTPS/SSH alternatives exist.
Storage	Encrypted with obselete encryption	🔗 Proof	Legacy flash credential file /flash/rw/store/user.dat uses reversible XOR with MD5(username plus hardcoded salt), shown in Tenable PoC. Obsolete protection of this element, NOT whole-flash encryption; later formats excluded.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Capability: named users/passwords, groups/policies, add/disable/delete accounts. Full refers to rubric lifecycle/less-privileged roles, not safe defaults or later complexity features.
Authentication	Basic	🔗 Proof	Basic: account/password management exists, but guide documents physical jumper/button reset and recovery with no account-authentication step. Not remote unauthenticated login; original RB750 has no serial port.
Brute-force protection	Exist	🔗 Proof	Configured capability only: administrator enables documented firewall/address-list SSH brute-force rules. NOT factory-default or universal WebFig/Winbox lockout. 2016 meeting material corroborates legacy capability.
Event logging	Access event logged	🔗 Proof	RouterOS account log records user/source/service login and logout. Shared RouterOS6 capability, not a hands-on test of this RB750 or guarantee of persistent retention.
Passwords	Default/Common/Easy to guess	🔗 Proof	Exact original-board guide: admin/no password. Historical pre6.43 baseline only; not later forced-change/unique-password models. No default-change requirement invented.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Historical RouterOS 6.x before 6.43 (not current firmware) (Companion App: )
Hardware (CPU / GPU)	CPU: Atheros AR7240, 400 MHz • GPU:
Memory & Storage	Memory: 32 MB RAM • Storage: 64 MB NAND
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Documentation-only HISTORICAL assessment, not hardware test/current-firmware certification. Original RB750 only, not G/GL/r2/Gr3. Pre6.43 RouterOS; VPNFilter source does not pin victim firmware/count. Rare/Very common are qualitative judgments, not measured frequency. HTTP management channel; legacy flash credential file; configured SSH firewall capability, not universal defaults. Official announcement date, not first shipment: 14 July 2009. Exact RB7506.42.1 applicability: model report. Original OEM guide preserved by specialist; original OEM product URL404, product identity/lifecycle from named reseller. Legacy firewall evidence.