They have had several remote code execution vulnerabilities lately (summer 2018). While they were very quick to patch them they did not notify their customers i

They have had several remote code execution vulnerabilities lately (summer 2018). While they were very quick to patch them they did not notify their customers in any way. There was nothing on their website that said anything about the urgency. Instead of reusing functionality that exists in the router already (ssh?), the authentication for winbox is something they built themselves. It was in the winbox auth that the main security flaw was. It just looked really bad to me. The winbox client also downloads and runs any DLL that is sent by the winbox server. The winbox client has a windows certificate so all it's code is trusted. So own the router and you get the admins workstation too. It just feels like maybe they hired some random guy without much appreciation for security for doing winbox. The SMB server also had a rce a while ago. That said, I guess that if you disable winbox and stuff that should not face the internet, you are probably safe? Too much for me though. I would not feel safe.