Picking up on some of the multitudinous chatter about CVE-2026-59108 I took another look at /ip/services to confirm there was nothing open around the edges of our network.
I found a dynamic entry for 'log' listening on a random high UDP port. I disabled every damn 'feature' I can but it's still there.
Anyone have any ideas how to make it go away (as opposed to searching for the port number and adding it to a firewall drop list with a script)
You might want to post what you're seeing? My guess is MikroTik uses a socket for some internal operation/commands on localhost, so may in fact not be "exposed" just now visible. Now why something would use a UDP socket internally when there are UNIX sockets/etc. instead IDK.
Very good to proactively audit your devices, I wish more people would do this.
Could you send us your supout.rif file @LightnetBarry ? I would like to inspect it in detail before assuming anything. Just email it to support@mikrotik.com and refer to this thread, so people know to pass it to me. Thanks!
Care to share the port number you see?
I also see a dynamic entry "log", udp port 44297 ... only on my rb5009 (7.21.5 LT)
My second router, at a different location, doesn’t have this entry.
PS: Jira Ticket SUP-219875
it's a random port, different on every device.
Thanks to @normis for the follow-up.
In this case the port is a sending port for remote logging. The only way to disable remote logging (that I have found) is to change the logging action type (to e.g. 'echo'). Removing remote and src addresses just defaults these to 0.0.0.0 making me wonder where my logs would be sent...
Indeed the "log" port is the sending port for remote logging, but in my case it only appears on routers that indeed have remote logging configured and not on others.
Maybe it sticks when you have once configured remote logging and then later attempt to unconfigure it...