4 ms·

not even close that user friendly, and they had pretty serious security problems, i also use them, because they are powerful and cheap. https://nvd.nist.gov/vu

not even close that user friendly, and they had pretty serious security problems, i also use them, because they are powerful and cheap. https://nvd.nist.gov/vuln/detail/CVE-2018-14847 https://nvd.nist.gov/vuln/detail/CVE-2018-14847

funnybeam 7y ago
Just want to point out that the fact that there are CVEs does not mean they are insecure. All kit has security issues but the important thing is how open the manufacturer is about the issues and how quickly they fix them, and Mikrotik have always been very good in this area, regularly releasing updates Also, as all their devices run the same software, even devices that are years old will still be updated I often see people saying “Mikrotik is insecure” but this seems to be based solely on the fact that there are published security issues which they have patched. In my opinion that is the opposite of insecure Agree on the user friendliness though - I use them at home for personal stuff, but for work it is Unifi
- disiplus 7y ago
  the one linked is especially bad, i allows anybody to read the admin password. the problem is also that a lot of them are running old versions because the update process is not as straightforward as ubiquitu for example. i also run mikrotik at home and have deployed mikrotik and ubiquiti at out different offices. for the price you can hardly beat mikrotik and once you "get into it" it's fairly simple.
  - funnybeam 7y ago
    Yes, that’s bad but note that even unpatched it is only an issue if the GUI management port has been left open - which seems to be the case with all the security issues people highlight with Mikrotik I wouldn’t disagree that management ports should probably be locked down out of the box but I would expect anyone reading this to apply some basic lockdown when setting up any device I just want to offer a counterpoint to an assertion that I often see here claiming they are insecure which I don’t think is justified Certainly if you are not into networking and want something that just works then Unifi is great, but if you want something with bucketloads more functionality and don’t mind getting your hands dirty then don’t be put off Mikrotik due to security concerns
  - hackmiester 7y ago
    You just upload a file and reboot... that seems like a pretty simple procedure to me...?
    - xeeeeeeeeeeenu 7y ago
      There's also the automatic upgrade option, so you don't have to upload anything manually: https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS#Automatic_upgrade https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS#Aut...
    - milankragujevic 7y ago
      Yes, and IMO its less likely to "ruin" the device (i.e. reset all settings on a roof-mounted CPE that you are upgrading remotely) than Unifi updates for LiteBeam... Though I have only used MikroTik SXT and SXTsq and Ubiquiti LiteBeam M5 so I am not the best to judge.
  - deleted 7y ago
    [deleted]
  - mopsi 7y ago
    > the one linked is especially bad, i allows anybody to read the admin password. Only if you have exposed management port to the internet, which you should never do.
stiray 7y ago
This one was for management port and was fixed before the CVE came out. There are two points: opening management interface to the internet is... Lets say... Weird. The second one, they are extremely responsive to security issues.
tgsovlerkhgsel 7y ago
Disabling (access to) WinBox should be the first thing to do on a Mikrotik. Most of their serious security issues are in WinBox. The Web UI seems to be a perfect equivalent if you want a GUI to manage your one box at home, and SSH should do the trick for automation. Is there any reason to use their proprietary (Windows-only) software to configure the router?
- garaetjjte 7y ago
  WebFig is just clunky and slow. Winbox is so much better, faster, with MDI, and works fine on Wine.

funnybeam 7y ago

Just want to point out that the fact that there are CVEs does not mean they are insecure. All kit has security issues but the important thing is how open the manufacturer is about the issues and how quickly they fix them, and Mikrotik have always been very good in this area, regularly releasing updates Also, as all their devices run the same software, even devices that are years old will still be updated I often see people saying “Mikrotik is insecure” but this seems to be based solely on the fact that there are published security issues which they have patched. In my opinion that is the opposite of insecure Agree on the user friendliness though - I use them at home for personal stuff, but for work it is Unifi

disiplus 7y ago
the one linked is especially bad, i allows anybody to read the admin password. the problem is also that a lot of them are running old versions because the update process is not as straightforward as ubiquitu for example. i also run mikrotik at home and have deployed mikrotik and ubiquiti at out different offices. for the price you can hardly beat mikrotik and once you "get into it" it's fairly simple.
- funnybeam 7y ago
  Yes, that’s bad but note that even unpatched it is only an issue if the GUI management port has been left open - which seems to be the case with all the security issues people highlight with Mikrotik I wouldn’t disagree that management ports should probably be locked down out of the box but I would expect anyone reading this to apply some basic lockdown when setting up any device I just want to offer a counterpoint to an assertion that I often see here claiming they are insecure which I don’t think is justified Certainly if you are not into networking and want something that just works then Unifi is great, but if you want something with bucketloads more functionality and don’t mind getting your hands dirty then don’t be put off Mikrotik due to security concerns
- hackmiester 7y ago
  You just upload a file and reboot... that seems like a pretty simple procedure to me...?
  - xeeeeeeeeeeenu 7y ago
    There's also the automatic upgrade option, so you don't have to upload anything manually: https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS#Automatic_upgrade https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS#Aut...
  - milankragujevic 7y ago
    Yes, and IMO its less likely to "ruin" the device (i.e. reset all settings on a roof-mounted CPE that you are upgrading remotely) than Unifi updates for LiteBeam... Though I have only used MikroTik SXT and SXTsq and Ubiquiti LiteBeam M5 so I am not the best to judge.
- deleted 7y ago
  [deleted]
- mopsi 7y ago
  > the one linked is especially bad, i allows anybody to read the admin password. Only if you have exposed management port to the internet, which you should never do.

stiray 7y ago

This one was for management port and was fixed before the CVE came out. There are two points: opening management interface to the internet is... Lets say... Weird. The second one, they are extremely responsive to security issues.

tgsovlerkhgsel 7y ago

Disabling (access to) WinBox should be the first thing to do on a Mikrotik. Most of their serious security issues are in WinBox. The Web UI seems to be a perfect equivalent if you want a GUI to manage your one box at home, and SSH should do the trick for automation. Is there any reason to use their proprietary (Windows-only) software to configure the router?

garaetjjte 7y ago
WebFig is just clunky and slow. Winbox is so much better, faster, with MDI, and works fine on Wine.