MEDIUM: Accessible MikroTik Service Report

DESCRIPTION LAST UPDATED: 2026-09-13

DEFAULT SEVERITY LEVEL: MEDIUM

This report contains MikroTik devices that respond to MikroTik Bandwidth test server (btest) or WinBox queries.

These protocols should not be exposed to the Internet. Additionally, they may be used to enable attacks when vulnerabilities in these services are uncovered (for example CVE-2026-67277).

Severity levels are described here.

Filename(s): scan_miktrotik_service, scan6_mikrotik_service

Fields

  • timestamp
    Timestamp the event occured in UTC+0
  • severity
    Severity level
  • ip
    IP of the device
  • protocol
    Protocol
  • port
    Port of the service
  • hostname
    Reverse DNS name of the device in question
  • tag
    tag which may be mikrotik, winbox, mikrotik-btest etc
  • asn
    ASN of where the device in question resides
  • geo
    Country where the device in question resides
  • region
    State / Province / Administrative region where the device in question resides
  • city
    City in which the device in question resides
  • naics
    North American Industry Classification System Code
  • hostname_source
    Hostname (either from DNS or SSL cert)
  • sector
    Sector to which the device belongs to
  • version
    MikroTik version
  • data_2000
    Data from btest service
  • data_winbox
    Data from Winbox service

Our 150 Report Types

« Back to Network Reporting