MikroTik hEX PoE (RB960PGS)
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Assessment scope: Documentation-based assessment of the original RouterOS 6 hardware generation. Product capabilities are distinguished from historical vulnerabilities and initial-password policy. Vulnerability applicability is specifically RouterOS 6.40.6, not a claim about patched firmware today. No physical units, installed configuration or network traffic were inspected. LAN HTTP management and enabled neighbor discovery are the communication paths evaluated. Storage rates the weak reversible protection of the legacy local credential database, not all data on the flash. Account-management and brute-force items rate supported capabilities, not evidence of their activation. Later hardware revisions and sticker-password units are excluded from the legacy initial-password claim.
Model identification and date evidence
- Manufacturer product page: exact model RB960PGS, RouterOS, RAM and storage specifications.
- Official newsletter: 2016-11 (official announcement month; exact retail day not established). This is the documented announcement month, not an invented exact retail date.
- Historical model/family guide: initial administrator password and initial management procedure. The guide applies to the original hardware generation.
Criterion evidence and interpretation
Scores below apply the WikiIoT Methodology to the stated scope. Scores are the assessor's qualitative rubric judgments; sources establish the underlying facts, not externally published scores or model-specific incident rates.
Known hardware tampering (2)
With protected RouterBOOT disabled, physical possession permits reset or network reinstallation. This documented local recovery route justifies the intermediate category in this assessment; it is not a measured incident rate.
Known vulnerabilities (3)
RouterOS 6.40.6 is in the vendor-confirmed affected range 6.30.1 to 6.40.7 for CVE-2018-14847, fixed in 6.40.8. CVE-2018-7445 also affects the SMB service before the 6.40.7 backport fix. Multiple serious applicable vulnerabilities support the qualitative category Very common, not a measured incident rate. Exposure depends on service reachability.
Prior attacks (3)
Trustwave documented a 2018 RouterOS cryptojacking campaign and over 170,000 MikroTik devices bearing the same CoinHive site key. This supports high platform-level attack history, not an infection count for this exact model.
Updatability (1)
The historical release sequence shows 6.40.6 on 20 February 2018, 6.40.7 on 29 March and 6.40.8 on 23 April. The latter releases include SMB and WinBox security fixes.
Authentication with other systems (2)
Management supports user authentication, while MNDP/CDP/LLDP neighbor discovery exchanges device information on the local link without a prior user login. Under the discovery-enabled scope, authentication covers only part of the interactions.
Communications (3)
The assessed legacy LAN management path uses HTTP WebFig. HTTP carries management traffic without TLS. HTTPS or SSH support elsewhere does not encrypt this HTTP path; this score addresses that documented unprotected channel.
Storage (2)
For the stated legacy RouterOS 6.40.6 scope, the local user database stores reversibly protected credentials. The original security analysis describes weak encoding and recovery of stored usernames/passwords; the published decoder explicitly derives a key with MD5(username + a fixed constant) and applies repeating XOR. This is obsolete reversible credential protection, scored 2 under the WikiIoT storage rubric. The vendor separately confirms extraction of the system user database in affected releases. This finding concerns stored credentials, not encryption of the whole flash and not an assertion that a configuration backup was created.
- Original analysis: Decoding the User Database
- Published credential decoder
- Vendor affected-version and user-database advisory
Account management (1)
RouterOS supports creating and deleting users, changing passwords, and assigning read, write, full or custom policy groups. These documented account-management capabilities meet the full-management criterion.
Authentication (2)
The evaluated management mechanism is local username/password authentication. RouterOS exposes local users and groups; this assessment does not assume deployment of certificate-based login or an external authentication service.
Brute-force protection (1)
WikiIoT defines this criterion by whether the system CAN set a limit to reduce password guessing. MikroTik provides a working SSH firewall/address-list example with staged connection thresholds, expiry times and blacklisting. This establishes configurable protection (Exist, 1). Rules must be configured; this is not a default-enabled lockout claim or protection for every service. Connection counting is not an exact count of failed passwords, and successful login does not clear the lists.
Event logging (1)
RouterOS documents account login and logout events with the username, source address and access method. This meets the access-event logging criterion; it does not establish immutable logs or complete request-level auditing.
Passwords (3)
The historical model/family guide states there is no password by default. This rates legacy initial-password policy, not newer sticker-password units or actual deployed units.
Calculation
Device: ceiling((2+3+3+1)/4) = 3. System: ceiling((2+3+2)/3) = 3. User Authentication: ceiling((1+2+1+1+3)/5) = 2. GRAS = 3+3+2 = 8; IDRS grade D.
This historical assessment does not imply that patched RouterOS versions retain the cited vulnerabilities.
