I upgraded my Routerboard to v7.15, after apdate New login created auto, username: System, so i can not access it as admin with full rights . please suggest System login password if possible
Very strange. Did this really happen right after the update?
Yes
I haven’t encountered this. All updated routers do not have the “System” user. Just the first thing that came to mind was that the router was compromised
There was far too little information provided. Did the “admin” group exist before the upgrade? Could you still log in with the “admin” user before the upgrade? What version was it before the upgrade? Was the user list actually checked before the upgrade?
please suggest System login password if possible
wtf? Even though you are a MikroTik trainer, you are asking such a question?
If you click on the group tab - whats the difference between full and admin?
I would probably try to extract the current config and then import it back with “keep-users=no” (dont forget to add a custom user to your rsc file).
Doing a fresh netinstall is probably a safer bet to just wipe the device.
before upgrade, there was no any system user or admin group but after update its happening.
I think it’s worth writing to support@mikrotik.com and clarifying whether such a user could appear after the update. Because at first glance it looks like the router is hacked
there is no hack possibity, becase i have not connect to WAN side yet, just open box and upgrade
Can be compromised from LAN side as well…
Must be compromised or you ran some custom scripts which created this user/group and changed existing group of admin with your upgrade or something.
only laptop connected with router.
Is there a solution for this issue?
It happened to me. During the first installation of CHR on a DigitalOcean Droplet, there are two default users: ‘System’ in the ‘full’ group and ‘admin’ in the ‘admin’ group. The ‘admin’ user cannot access Telnet, created scripts are not working, and the API service cannot be used.
it was probably exposed with a public IP during installation and they hacked it. happened to me too.
Username: admin
password:
?
Good morning all
We have a router doing this as well this morning! RouterOS 6.49.15. Was in service at the time on a customer’s site. I suspect it has been pwned somehow! Hardware is a hEX (mmips). Firmware also 6.49.15. A strong password was used and IP management restricted to LAN and a small range of trusted external addresses!
I had a same issue, it is the api service didn’t turn off, someone hacked in and did the same thing.
Same here! New installation on AWS,i can’t do anything because i don’t have “system” password.
I have the same issue with 3 devices : 2 hex and one CCR2004-12G
Same stuff via api.
MikroTik please react! This is common