MikroTik RouterBOARD 1200 (RB1200)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Qualitative physical-exposure judgment, not attack prevalence: OEM RB1200 manual documents RS232 and power-up configuration reset without password. Requires physical access; reset can be disabled.
Known vulnerabilities	Rare	🔗 Proof	Qualitative judgment: CVE-2018-14847 discloses the legacy credential DB on stable 6.29-6.42. Not a measured model rate or a claim against patched 6.42.1+.
Prior attacks	Rare	🔗 Proof	Qualitative judgment: Talos names RB1200 in its 6 June 2018 VPNFilter Known Affected Devices list. Remote observations limit exact model/version attribution; no model infection count or universal compromise claimed.
Updatability	Very common	🔗 Proof	Historical cadence judgment: repeated RouterOS 6 stable releases March-May 2018. Not automatic installation, continued hardware sale, or a current-support guarantee.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[1] [2] 🔗 Proof	Mixed capability: SSH user/public-key and host-key authentication exists; OEM network boot uses BOOTP/DHCP/TFTP. RFC1350 states TFTP lacks authentication. Not universal mutual authentication.
Communications	No encryption	🔗 Proof	Channel only: historical HTTP WebFig www/80, not all traffic. May 2018 service listing shows HTTP; configured HTTPS/SSH alternatives exist. No claim about every password handshake.
Storage	Encrypted with obselete encryption	🔗 Proof	Element only: legacy NAND credential DB /flash/rw/store/user.dat, not whole-flash encryption. PoC reverses XOR with MD5(username + hardcoded salt); obsolete reversible protection before 6.43.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Shared RouterOS6 capability: named users/passwords, groups/policies and add/disable/delete accounts; not safe defaults or later password-complexity features.
Authentication	Basic	🔗 Proof	Normal named-user login exists, but OEM RB1200 manual states physical reset needs no password/confirmation (disable option available). Not unauthenticated remote login or arbitrary firmware acceptance.
Brute-force protection	Exist	[3] 🔗 Proof	Configured capability ONLY: administrator-installed firewall/address-list rules block repeated SSH connections; official example and 2016 training. Not factory-default or universal service lockout.
Event logging	Access event logged	🔗 Proof	Shared RouterOS capability: account access logs include user/source/service; historical 2018 logs corroborate. No hands-on model test or guaranteed persistent retention.
Passwords	Default/Common/Easy to guess	🔗 Proof	Exact OEM RB1200 guide states admin/no password. Historical pre6.43 baseline only; later forced-change/unique-password defaults not assessed.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	RouterOS 6.x before 6.43 (historical) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage: Internal NAND; capacity omitted (conflicting vendor documents)
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Historical documentary assessment, NOT device testing. Exact ORIGINAL RB1200; no AH/Hx2/AHx2/AHx4/Dude/replacement substitutions. Pre-6.43 RouterOS 6; CVE example stable 6.29-6.42. HTTP channel only; credential DB only; SSH filtering configured, not default. Rare/Very common are qualitative judgments, not statistics. Date is dated official product announcement (not first shipment). Discontinued = End of sale, not software EOL. Announcement evidence: MikroTik staff post 19 May 2011. Direct RouterOS6 model applicability: vendor6.42 changelog names RB1200 AES correction. VPNFilter known-affected list does not pin victim firmware/count. Shared platform evidence is not on-device testing. 2016 firewall capability.