For several days now I've been having a serious problem with my MikroTik router: when I add multiple users for access, they all suddenly disappear without leaving a trace in the logs. Only the default, passwordless access remains, which poses a significant security risk. At first, I thought it might be due to insufficient memory, but I ruled that out. I still haven't been able to identify the cause of the problem.
Most probably you have an empty or insecure firewall configuration, in combination with the default account with the empty password, that would result in your device being hacked immediately soon after being online.
You should reset the configuration, then set the password immediately for the default admin account before being online. And you should apply a secure firewall config, for example you can copy the MikroTik defconf firewall rules.
Hi, since version 7.18 this behavior was very frequent, to the point that we even had problems with the complete deletion of the configuration. It was never a firewall issue. Ports and passwords were changed more than once, and it always happened. This behavior stopped in version 7.20.6. Another thing we noticed was that we even replaced some computers; the NAND memory of the device gradually decreased, and when that happened, the configuration was lost.
This is a RouterOS 7.18.x bug on CCR2116. We hit the same issue where users and sometimes configs vanished with no logs. It was not firewall or access related. Upgrading to 7.20.6 or newer fixed it and the problem never returned.