MikroTik RouterBOARD 450 (RB450)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Qualitative physical-susceptibility judgment, not prevalence: original RB450 has RS232/RouterBOOT and accessible reset hole. Manual distinguishes RB450 from G; reset needs physical access, can be disabled.
Known vulnerabilities	Rare	🔗 Proof	Qualitative judgment: historical CVE-2018-14847 reads user database; affected stable 6.29-6.42, fixed 6.42.1. Patched builds not called vulnerable; no measured incidence.
Prior attacks	Rare	🔗 Proof	Talos 6 June 2018 Known Affected Devices explicitly lists RB450 for VPNFilter. Rare is qualitative, not measured frequency. Exact victim firmware/count not given; remote-attribution caveat applies.
Updatability	Very common	🔗 Proof	Historical cadence judgment: multiple official RouterOS6 stable releases in March-May2018. Update capability/cadence, not automatic patching or current hardware sales.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Partial capability judgment: SSH supports user/public-key and host-key authentication; documented BOOTP/DHCP/TFTP network boot lacks mandatory peer authentication. Not universal mutual auth.
Communications	No encryption	🔗 Proof	Assessed channel is historical HTTP WebFig management (www/80), NOT all traffic. 2018 service example has www-ssl disabled/no certificate. Configured HTTPS/SSH alternatives exist.
Storage	Encrypted with obselete encryption	🔗 Proof	Legacy flash credential file /flash/rw/store/user.dat uses reversible XOR with MD5(username plus hardcoded salt), shown in Tenable PoC. Obsolete protection of this element, NOT whole-flash encryption; later formats excluded.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Capability: named users/passwords, groups/policies, add/disable/delete accounts. Full refers to rubric lifecycle/less-privileged roles, not safe defaults or later complexity features.
Authentication	Basic	🔗 Proof	Basic: normal management user/password access, but manual says power-up reset hole clears software configuration with no confirmation/password. Can be disabled; not unauthenticated remote login.
Brute-force protection	Exist	🔗 Proof	Configured capability only: administrator enables documented firewall/address-list SSH brute-force rules. NOT factory-default or universal WebFig/Winbox lockout. 2016 meeting material corroborates legacy capability.
Event logging	Access event logged	🔗 Proof	RouterOS account log records user/source/service login and logout. Exact RB450 historical discussion corroborates FTP/WebFig events on6.40.x. Not hands-on testing or guaranteed persistent retention.
Passwords	Default/Common/Easy to guess	🔗 Proof	Exact original-board guide: admin/no password. Historical pre6.43 baseline only; not later forced-change/unique-password models. No default-change requirement invented.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Historical RouterOS 6.x before 6.43 (not current firmware) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Documentation-only HISTORICAL assessment, not hardware test or current-firmware certification. Exact RB450 only, not RB450G/Gx4. Pre6.43 RouterOS; prior VPNFilter source does not pin victim firmware. Rare/Very common are qualitative judgments, not measured frequency. HTTP management channel; legacy flash credential file; configured SSH firewall capability, not universal defaults. Announcement date, NOT May availability/first shipment: 28 April 2008. Exact historical RouterOS6 and access logs: model discussion. Conflicting optional hardware quantities omitted. Legacy firewall: 2016 material.