You do not have permission to edit this page, for the following reasons:
'''Assessment scope''': Documentation-based assessment of the original RouterOS 6 hardware generation. Product capabilities are distinguished from historical vulnerabilities and initial-password policy. Vulnerability applicability is specifically RouterOS 6.40.6, not a claim about patched firmware today. No physical units, installed configuration or network traffic were inspected. LAN HTTP management and enabled neighbor discovery are the communication paths evaluated. Storage rates the weak reversible protection of the legacy local credential database, not all data on the flash. Account-management and brute-force items rate supported capabilities, not evidence of their activation. Later hardware revisions and sticker-password units are excluded from the legacy initial-password claim. == Model identification and date evidence == * [https://mikrotik.com/product/RB750Gr3 Manufacturer product page]: exact model RB750Gr3, RouterOS, RAM and storage specifications. * [https://box.mikrotik.com/d/b5b340fd548c40fe97a3/files/?p=/news_73.pdf&dl=1 Official newsletter]: 2016-11 (official announcement month; exact retail day not established). This is the documented announcement month, not an invented exact retail date. * [https://cdn.mikrotik.com/web-assets/product_files/RBhEX_191018.pdf Historical model/family guide]: initial administrator password and initial management procedure. The guide applies to the original hardware generation. == Criterion evidence and interpretation == Scores below apply the WikiIoT Methodology to the stated scope. Scores are the assessor's qualitative rubric judgments; sources establish the underlying facts, not externally published scores or model-specific incident rates. === Known hardware tampering (2) === With protected RouterBOOT disabled, physical possession permits reset or network reinstallation. This documented local recovery route justifies the intermediate category in this assessment; it is not a measured incident rate. * [https://help.mikrotik.com/docs/spaces/ROS/pages/40992878/RouterBOARD RouterBOARD / RouterBOOT] === Known vulnerabilities (3) === RouterOS 6.40.6 is in the vendor-confirmed affected range 6.30.1 to 6.40.7 for CVE-2018-14847, fixed in 6.40.8. CVE-2018-7445 also affects the SMB service before the 6.40.7 backport fix. Multiple serious applicable vulnerabilities support the qualitative category Very common, not a measured incident rate. Exposure depends on service reachability. * [https://mikrotik.com/supportsec/winbox-vulnerability/ MikroTik WinBox security advisory] * [https://download.mikrotik.com/routeros/6.40.7/CHANGELOG RouterOS 6.40.7 changelog] * [https://download.mikrotik.com/routeros/6.40.8/CHANGELOG RouterOS 6.40.8 changelog] === Prior attacks (3) === Trustwave documented a 2018 RouterOS cryptojacking campaign and over 170,000 MikroTik devices bearing the same CoinHive site key. This supports high platform-level attack history, not an infection count for this exact model. * [https://www.levelblue.com/blogs/spiderlabs-blog/mass-mikrotik-router-infection-first-we-cryptojack-brazil-then-we-take-the-world Trustwave: mass MikroTik infection] === Updatability (1) === The historical release sequence shows 6.40.6 on 20 February 2018, 6.40.7 on 29 March and 6.40.8 on 23 April. The latter releases include SMB and WinBox security fixes. * [https://download.mikrotik.com/routeros/6.40.6/CHANGELOG RouterOS 6.40.6 changelog] * [https://download.mikrotik.com/routeros/6.40.7/CHANGELOG RouterOS 6.40.7 changelog] * [https://download.mikrotik.com/routeros/6.40.8/CHANGELOG RouterOS 6.40.8 changelog] === Authentication with other systems (2) === Management supports user authentication, while MNDP/CDP/LLDP neighbor discovery exchanges device information on the local link without a prior user login. Under the discovery-enabled scope, authentication covers only part of the interactions. * [https://help.mikrotik.com/docs/spaces/ROS/pages/24805517/Neighbor+discovery Neighbor discovery] * [https://help.mikrotik.com/docs/spaces/ROS/pages/8978504/User User management] === Communications (3) === The assessed legacy LAN management path uses HTTP WebFig. HTTP carries management traffic without TLS. HTTPS or SSH support elsewhere does not encrypt this HTTP path; this score addresses that documented unprotected channel. * [https://help.mikrotik.com/docs/spaces/ROS/pages/103841820/Services IP services] * [https://cdn.mikrotik.com/web-assets/product_files/RBhEX_191018.pdf Historical model/family guide] === Storage (2) === For the stated legacy RouterOS 6.40.6 scope, the local user database stores reversibly protected credentials. The original security analysis describes weak encoding and recovery of stored usernames/passwords; the published decoder explicitly derives a key with MD5(username + a fixed constant) and applies repeating XOR. This is obsolete reversible credential protection, scored 2 under the WikiIoT storage rubric. The vendor separately confirms extraction of the system user database in affected releases. This finding concerns stored credentials, not encryption of the whole flash and not an assertion that a configuration backup was created. * [https://blog.n0p.me/2018/05/2018-05-21-winbox-bug-dissection/ Original analysis: Decoding the User Database] * [https://github.com/BigNerd95/WinboxExploit/blob/master/extract_user.py?plain=1 Published credential decoder] * [https://mikrotik.com/supportsec/winbox-vulnerability/ Vendor affected-version and user-database advisory] === Account management (1) === RouterOS supports creating and deleting users, changing passwords, and assigning read, write, full or custom policy groups. These documented account-management capabilities meet the full-management criterion. * [https://help.mikrotik.com/docs/spaces/ROS/pages/8978504/User User management] === Authentication (2) === The evaluated management mechanism is local username/password authentication. RouterOS exposes local users and groups; this assessment does not assume deployment of certificate-based login or an external authentication service. * [https://help.mikrotik.com/docs/spaces/ROS/pages/8978504/User User management] * [https://cdn.mikrotik.com/web-assets/product_files/RBhEX_191018.pdf Historical model/family guide] === Brute-force protection (1) === WikiIoT defines this criterion by whether the system CAN set a limit to reduce password guessing. MikroTik provides a working SSH firewall/address-list example with staged connection thresholds, expiry times and blacklisting. This establishes configurable protection (Exist, 1). Rules must be configured; this is not a default-enabled lockout claim or protection for every service. Connection counting is not an exact count of failed passwords, and successful login does not clear the lists. * [https://help.mikrotik.com/docs/spaces/ROS/pages/268337176/Bruteforce+prevention SSH brute-force prevention] === Event logging (1) === RouterOS documents account login and logout events with the username, source address and access method. This meets the access-event logging criterion; it does not establish immutable logs or complete request-level auditing. * [https://help.mikrotik.com/docs/spaces/ROS/pages/328094/Log Logging] === Passwords (3) === The historical model/family guide states there is no password by default. This rates legacy initial-password policy, not newer sticker-password units or actual deployed units. * [https://cdn.mikrotik.com/web-assets/product_files/RBhEX_191018.pdf Historical initial-password guide] == Calculation == Device: ceiling((2+3+3+1)/4) = 3. System: ceiling((2+3+2)/3) = 3. User Authentication: ceiling((1+2+1+1+3)/5) = 2. GRAS = 3+3+2 = 8; IDRS grade D. This historical assessment does not imply that patched RouterOS versions retain the cited vulnerabilities.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
