I've never sad this, but God, please send to hell directly the person who wrote such small and unreadable default password.
Thanks.



hap ax2. no other stickers with password btw.

Is there a hell for labelprinters?

It's security feature against hackers with bad vision

All of the Mikrotik devices I ever dealt with (hEX, RB5009, hAP ac2, CRS125, LDF 2) had no default password. Did something change? Is your router provided by ISP?

New models come with default password which is on the cardboard box and also on the router itself.
ALSO it is available from your distributor in a digital document / CSV.

Newer batches have improved label print quality and do not have ambiguous characters (0/O etc)

Thanks. When has this change been made? Does it apply to all newly produced devices or just specific new models?

During this year it has been slowly rolling out for home user type of models. Home users often never connect to their devices, leaving them without protection and open for Trojan software from the LAN side.

During this year it has been slowly rolling out for home user type of models. Home users often never connect to their devices, leaving them without protection and open for Trojan software from the LAN side.

Not that it actually matters[1], but earlier (in other threads) it was mentioned that the change was prompted by the need for compliance with this (or that) EU regulation (possibly the GDPR or more strictly one of the possible interpretation of its vague requirements).

Now you put the blame on the (stupid) home/hobby users.

Still it would be nice to know if it is a new, own, Mikrotik initiative to protect the (stupid) home/hobby users from themselves and their lack of security protocols implementation or if it is the EU that is "protecting" us.

[1] though I would like to know, whenever a little bit of freedom is removed, who does that and what reason there is behind that - even tiny - removal

It is one and the same. Many country regulators are working towards such requirements, not just the EU. And they are doing this because of the users. Did you think it was just baseless regulation to annoy people?

I don't think it's a removal of freedom. It would be for example if the password couldn't be changed.

I think the default password is actually a good idea, as I know from experience how common it is for people people to not care about configuring their equipment and just want it to work out of the box. I don't mean networking hobbyists, but rather an average Joe who just wants Internet, or an electrician who has to install a network connection for collecting production data from a PV power plant.

It is one and the same. Many country regulators are working towards such requirements, not just the EU. And they are doing this because of the users. Did you think it was just baseless regulation to annoy people?

I know I do sound picky, basically because I am actually picky (besides being old and grumpy, and cheap, but this latter is not relevant here), but what the EU (and other regulators) often do is
1) do something (that usually means some added regulation, often causing lots of headaches in the population that must comply)
2) communicate some (usually bogus) reasons[1] why they did that (while patting themselves on the shoulders for how clever they have been)

Of course there is nothing that we (stupid) home/hobby users can do about the regulation or the decision by the manufacturer but I still would like to know if I have to thank for this (tiny in the specific) annoyance the EU or Mikrotik.

With a good magnifying glass and adequate lighting I did manage to decrypt the password on the label of some just arrived hap AX lite's, probably this is one of the new batches that do not have "ambiguous" characters (or I was lucky and the password did not contain them by pure chance), so not a real problem, only an annoyance, and there are two levels in it, one is the regulation or decision by Mikrotik, the other one is the way it has been implemented, the OP is venting about the latter only and I have to concur with him.

[1] mind you, very often there are good reasons, only the stated ones are different

I grab my phone to photograph the label on each one on unboxing.

• I have a permanent record on hand (including MAC addresses, serial) in case of need.

• I can easily expand the view for readability, no separate magnifier involved.

• I can see the passwords on or adjacent to my computer when using them, rather than peering at the router.

An SXT LTE6 kit 2023 that I bought yesterday has just arrived, and indeed it has a default password. I can read it clearly, presumably it's one of the newer labels but I don't have any of the old ones to compare.

Thanks for the info. No idea of that.

Regards.

New models come with default password which is on the cardboard box and also on the router itself.
ALSO it is available from your distributor in a digital document / CSV.

Newer batches have improved label print quality and do not have ambiguous characters (0/O etc)

Imho,
Why we need to depends on distributor for that as already mentioned in the yt vídeo about this, they are not Required to provide that file.
Why Mikrotik don't provide a tool in Mikrotik account that by informing the serial number it shows the serial..
This is a cleaner and better user experience...
My hap ax2 I had to basically guess if was a K or R I have used Google lens to help me out now I have this written in my password manager...

New models come with default password which is on the cardboard box and also on the router itself.
ALSO it is available from your distributor in a digital document / CSV.

Newer batches have improved label print quality and do not have ambiguous characters (0/O etc)

Imho,
Why we need to depends on distributor for that as already mentioned in the yt vídeo about this, they are not Required to provide that file.
Why Mikrotik don't provide a tool in Mikrotik account that by informing the serial number it shows the serial..
This is a cleaner and better user experience...
My hap ax2 I had to basically guess if was a K or R I have used Google lens to help me out now I have this written in my password manager...

Or just throw separate piece of paper into the box, with that password, with properly sized font like 10 or 12.
I bought 3 new RB devices lately and it was a real pain to get these up and running,
since that password was pretty much unreadable and my eyes literally bleeded 2 days in a row afterwards from attempts to decipher these.

I still don't understand how other vendors get away (legally speaking) with forcing users to change the default password on first login and MikroTik had to resolve to this random password nonsense...

It would seem that simply forcing users to change the password in order to use the device is enough (legally) if everyone else is doing it.

The only place where I've seen random passwords being forced is CPEs that ISPs give out to customers and AVM's hardware. No consumer product I've used so far has this random password policy.

Another potential label issue here.

Just bought a brand new hAP ax lite and neither of the label passwords work.

Tried resetting the device and when I RouterOS factory default it I can access it with winbox using MAC-address (obviously I've then lost all the nice configs)

Loading back the default settings gives me the correct IP and wifi functionality back but still the logins claim wrong passwords.

My label is readable but it has some ambigious characters (such as zeros) - tried various combinations.

Any change the label or wrong / swapped / corrupted ?

Also what to do? I don't want to manually configure everything from command line ...

It is a frustration, that could have been avoided.
Just received brand new hAP ax2, my first device in the ax series.
And I needed quite some tricks to get it started.
How can you sell a device like that in Europe, with so many traps for the end-user ???
Finally got in, thanks to quite some MT ROS experience.

New box, (not sealed but device seems untouched)

Could not get in, so following steps are taken.

- 5GHz wifi does not appear
- using cable in port ether2
- wrong password
- printed on the bottom of the device, and yes it is 1O and not 10 as password character
- once the base plate mounted, it might be hidden
- no other document with that information
- Didn't want to type in that wifi password. So changed wifi security to my default
- Added my own support user with admin rights

Disconnect cable, go via wifi
- No wifi 5 GHz seen
- back to cable, wifi1 is on 5860MHz , for europe ???? Not usable here. OK take wifi2 (2GHz)
- Windows starts with popups about WPA3
- Cannot log in. Winbox makes no connection, not with IP not with MAC. Nothing in discover. No Webfig connection.
- No Telnet, no MAC Telnet
- back to cable (using a mAP Lite to reach the device via ether2)
- hmmmm ... bridge is not on interface LAN list. Why is only ether2 on that list ?
- only way to connect is via ether2
- OK, lets open some paths ... Romon password set, bridge added on LAN interface list
- Many things open up with bridge on interface LAN list
- adding ether1 to bridge. (Well I need PoE in my LAN)
- Changed country in wifi1, switches to DFS freq 5680MHz
- wifi2 on 2GHz now uses 2427MHz, channel 4+8 , 40MHz wide, damn 2GHz jammer!
- set to 20MHz. Crowded area, lots of IoT devices, and somebody around is using channel 6 for non 802.11 wifi. 100% transmit time.
- ETSI not one of the wifi regions, country used
- Ready to upgrade the 7.8 ROS to 7.12, maybe then even to 7.13 (with that packages change)

Fun can begin ... even as the connection is dropped from time to time, and the ROS wifi menu shows unwanted things
What does it mean "skip 10 min CAC" , if choosing a wheater radar channel is exactly what the device then does on its own.
And far from stable yet.

Oh, the joys of a new toy, eh ?

It sounds more like when you order online a framed picture and you get instead a 1000 pieces puzzle of that picture, it is actually fun but somehow unexpected.

What does it mean "skip 10 min CAC" , if choosing a wheater radar channel is exactly what the device then does on its own

The regulatory Channel Availability Check (CAC) time before an AP is allowed to broadcast beacons on a DFS channel is 1 min.
For 5'600 to 5'650 MHz (116 to 128), EU resp ETSI mandates 10min CAC.

Maybe "skip 10 min CAC" means skipping (not using) channels with 10min mandated CAC time?

Did not skip it. That's the point.

Bizar thing is that so much was illogical. So bad that I did a reset with default config. They allow to keep the extra user configured.
Bridge ports where OK now !???!??? : ether2-ether5 to the bridge, and bridge (still?) in LAN interface list.
But again these odd frequencies. Maybe I need to update my understanding ... "/interface/wifiwave2/radio> print detail" gives a long list of new frequencies (SRD low power or not?)
Reading the default config script (under system), shows they insist on "indoor" installation.(in the comments). Why? IPX rating? There is even a sticker on the device "indoor use only". Only MT in some countries set used to block outdoor freq when it is set to installation=indoor. Based on what ?

The whole MT country specific WIFI regulation thing is currently in a bad state. 7.13.1 just broke it again in a new way. At least they are working on it.
It seems confusing to have country settings for VAPs. It makes no sense for VAPs sharing the same channel and radio HW to broadcast different country IDs. Especially Apple devices taking their local country setting from the first beacon the receive will be confused.

Please always report any sticker/password problems to support@mikrotik.com so we can find, fix the issue and improve the situation.

what's the problem - for me it's a plus for safety... and when I had to enter it, I took a photo and enlarged the photo on my phone