I built a free, open-source tool that audits switch and router security settings, and RouterOS
support just landed (6.x and 7.x, tested on CHR 7.25.1). Sharing it here because the findings on a
factory-default RouterOS might be useful even if you never use the tool.
What it checks on a factory-default CHR 7.25.1:
Telnet, FTP, HTTP (WebFig) and API enabled and reachable from any address (available-from empty)
/ip ssh strong-crypto=no: SHA-1 key exchange and weak ciphers still offered
MAC-Winbox answering on every interface
no NTP client, no remote syslog
RouterOS version vs. known critical / actively exploited CVEs. Each advisory records the first
fixed version of every release line. Example: the three RouterOS flaws CISA added to its
Known Exploited list in September 2026 are fixed in 6.49.21, 7.23.4 (long-term) and 7.24.2
(stable).
How it works:
read-only: it logs in over SSH, runs /export terse and some print terse commands, and
logs out. It never sends show-sensitive, so secrets are not collected.
it works with a group that has only ssh,read (no write, no sensitive). I tested that this
group sees everything needed and that changes are refused. Don't use the built-in read
group: it includes sensitive.
it can also assess Oxidized routeros backups without logging in. Side note: on RouterOS 7,
Oxidized stores /export show-sensitive (RADIUS secrets, SNMP passwords) unless remove_secret is set.
Two things I learned while testing, in case they help someone:
RouterOS has no SSH pre-login banner. /system note show-at-cli-login=yes shows the note before
the console/Telnet login prompt; over SSH it appears right after login (show-at-login).
Exports only list non-default settings, so a missing /ip service set telnet disabled=yes
means Telnet is still on.
Try it without touching your network. The demo simulates a small network with a
factory-default CRS326:
It's a preview for RouterOS, so I'd really like feedback from real CRS/CCR/hEX devices. In
particular: wrong verdicts, outputs that differ on your version, and checks you would add.
Good point, and LYSS already supports it. Nothing has to touch the router:
On the router: /export file=router (RouterOS 7 leaves secrets out by default; on 6.x use /export hide-sensitive file=router), then download router.rsc from Files.
On any PC: pip install lyss, then lyss audit --vendor mikrotik --level 2 router.rsc
It reads both the normal and the terse export. An export lists every setting that differs from the defaults, so a missing line tells you the default is still in place. That is enough to decide most checks:
Telnet, FTP, HTTP or API still enabled;
SSH strong-crypto;
SNMP;
RADIUS login;
remote syslog and NTP;
the login banner;
whether management sits on its own VLAN;
the RouterOS version against CISA's known-exploited list.
On a test router, 13 of the 20 checks are decided from the export alone.
What an export can't show: whether ports are actually up or unused, per-user idle timeouts (users aren't exported), and the RADIUS secret. Those stay "unknown"; they're never guessed.
The SSH mode is for people who want scheduled audits of many devices. It works with a group limited to ssh,read, without the sensitive policy. But the offline audit is a first-class option, and thanks for raising it: I'll make it more visible in the docs.
No install needed any more: paste the /export into https://lyss.dev/audit.html. LYSS runs entirely in the browser (Pyodide), nothing is uploaded, and the page's security policy blocks any other server.
--vendor is optional now. Run pip install --upgrade lyss, then lyss audit --level 2 router.rsc; the platform is detected from the export header.
New Level 3 checks for RouterOS 7, tested on CHR 7.25.1: bridge DHCP snooping, bridge ARP inspection (it exists in recent 7.x; older "MikroTik has no DAI" threads are out of date), an 802.1X server on access ports, and no neighbor discovery towards users. Use lyss audit --level 3 router.rsc.
One question for CRS3xx owners: how does /export show storm control on switch ports? Is it set ether2 storm-rate=..., or by port number? CHR has no switch chip, so I couldn't check, and that control stays "unknown" until I know the exact format.