Admin script in jobs after log in

Is this normal? I can see in my some gws when I log in (via winbox) I can see new job(s)…see attach.
obrázek_2021-01-25_203649.png
I`m confused because I tried about 10 MTs and there are half to half…somewhere I can see jobs after log in somewhere not).
Btw there are various ROS (6.43 yes, 6.47.8 yes, 6.48 yes, 6.44.5 yes, 6.45.5 no, 6.43.rc66 no, 6.43.8 no, 6.47.7 no…etc)…all in public IP.

On what version do you see this problem? Older version of Mikrotik are vulnerable for attack using Winbox.
What are listed in the Script tab?
Upgrade all routers to at least 6.45, I would suggest 6.47.9

Do you have access to the router using public IP to Winbox?
You should use VPN instead.

If you need to use Winbox and can not use VPN.

  1. Use another port than default.
  2. Use port knocking. This prevents someone from seeing open ports.
  3. Use a long and good password.
  4. Use access list to prevent any random internet from accessing your router.
  5. Log everything. (See my signature for example.)
  6. Upgrade firmware to latest stable release
  7. ++++

Couldnt see the versions mate? There are various ROS versions. Of course mostly Im using connection only from VPN range.
I know known ROS vulne. because I had hacked several gws a few year ago;o)

Do you have the terminal window open in Winbox?

Each terminal in Winbox spawns it’s own job - maybe you had a saved session that contained terminals, so when you logged in, Winbox re-launched those terminal windows, and that’s why you see active jobs?

Do you have the terminal window open in Winbox?

Each terminal in Winbox spawns it’s own job - maybe you had a saved session that contained terminals, so when you logged in, Winbox re-launched those terminal windows, and that’s why you see active jobs?

You`re right, Great work.

Not entirely true …
I have de-listed all jobs by closing terminal sessions on one router. On another, one is lingering on, regardless of the fact that all Terminal sessions are closed.