MikroTik RouterBOARD 1100 (RB1100)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Qualitative physical-exposure judgment, not attack prevalence: OEM RB1100 manual documents RS232 and power-up configuration reset without password. Requires physical access; reset can be disabled.
Known vulnerabilities	Rare	🔗 Proof	Qualitative judgment: CVE-2018-14847 discloses the legacy credential DB on stable 6.29-6.42. Not a measured model rate or a claim against patched 6.42.1+.
Prior attacks	Rare	🔗 Proof	Qualitative judgment: Talos names RB1100 in its 6 June 2018 VPNFilter Known Affected Devices list. Remote observations limit exact model/version attribution; no model infection count or universal compromise claimed.
Updatability	Very common	🔗 Proof	Historical cadence judgment: repeated RouterOS 6 stable releases March-May 2018. Not automatic installation, continued hardware sale, or a current-support guarantee.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[1] [2] 🔗 Proof	Mixed capability: SSH user/public-key and host-key authentication exists; OEM network boot uses BOOTP/DHCP/TFTP. RFC1350 states TFTP lacks authentication. Not universal mutual authentication.
Communications	No encryption	🔗 Proof	Channel only: historical HTTP WebFig www/80, not all traffic. May 2018 service listing shows HTTP; configured HTTPS/SSH alternatives exist. No claim about every password handshake.
Storage	Encrypted with obselete encryption	🔗 Proof	Element only: legacy NAND credential DB /flash/rw/store/user.dat, not whole-flash encryption. PoC reverses XOR with MD5(username + hardcoded salt); obsolete reversible protection before 6.43.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Shared RouterOS6 capability: named users/passwords, groups/policies and add/disable/delete; not later complexity-policy features or on-device testing.
Authentication	Basic	🔗 Proof	Normal named-user login exists, but OEM RB1100 manual states physical reset needs no password/confirmation (disable option available). Not unauthenticated remote login or arbitrary firmware acceptance.
Brute-force protection	Exist	[3] 🔗 Proof	Configured capability ONLY: administrator-installed firewall/address-list rules block repeated SSH connections; official example and 2016 training. Not factory-default or universal service lockout.
Event logging	Access event logged	🔗 Proof	Shared RouterOS capability: account access logs include user/source/service; historical 2018 logs corroborate. No hands-on model test or guaranteed persistent retention.
Passwords	Default/Common/Easy to guess	[4] [5] 🔗 Proof	Historical original RB1100 admin/blank default: Feb 2011 exact-model recovery reply explicitly states admin/blank and cites original C229 OEM manual; June 2011 exact-model initial-setup reply independently corroborates. Community documentary evidence, not a device test or OEM password quote.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	RouterOS 6.x before 6.43 (historical) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage: Internal NAND; capacity omitted (conflicting vendor documents)
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Historical documentary assessment, NOT device testing. Exact ORIGINAL RB1100; excludes AH/Hx2/AHx2/AHx4/Dude. Pre-6.43 RouterOS 6; CVE example stable 6.29-6.42. HTTP channel only; credential DB only; SSH filtering configured, not default. Rare/Very common are qualitative judgments, not statistics. Password default corroborated by two 2011 exact-model forum replies, not OEM password text. Date 2010-04-30 is official availability-newsletter date; index says Apr29; first reveal/shipment unproved. Discontinued = End of sale, not software EOL. Official availability newsletter: PDF dated30Apr2010, while official index says29Apr. RouterOS6 applicability: official6.38.1 changelog explicitly names RB1100. Password evidence is contemporary community documentation, not OEM statement or successful login test; migration-era edits not archive-verified. Physical RS232/boot recovery and NAND confirmed in original OEM-authored guide. Shared firmware sources apply to historical PPC RouterOS, not AHx4 ARM.