Any ideas why an “unknown” interface has suddenly appeared in the Interface List on (some of) our client routers?
ROS is currently 6.40.4 (Not upgraded to 6.42.7 as we had a problem with a previous upgrade which meant we had to factory reset the router and reconfigure it…)
Thanks
Not interface list but bridge port, is to be expected when former interface and bridge are deleted from configuration. Are there any clues in the system log / system history?
Regarding the vulnerability found in 6.40.4:
If you’re not sure that Winbox port is properly firewalled, upgrade to 6.40.8 (bugfix) asap. Make configuration export before upgrading (/export file=config.rsc). Reset all user account passwords after update. Check configuration thoroughly for malicious scripts, proxy settings and scheduler and remove those entries. Post configuration here (/export hide-sensitive) if not sure.
Check https://blog.mikrotik.com/security/winbox-vulnerability.html for more details on the vulnerability.