Port 8291 – MikroTik Winbox
TCPPort 8291 is the MikroTik Winbox management protocol port. Winbox provides graphical RouterOS administration. MikroTik routers exposed on port 8291 have been targeted by large-scale botnets (Meris, 2021). Always change the default admin password, restrict Winbox to management IPs, and keep RouterOS updated.
Port Number
8291
Protocol
TCP
Service
MikroTik RouterOS Winbox
Range
IANA Registered (1024–49151)
Description
Security risks
- 1CVE-2018-14847 (CVSS 9.1): Winbox directory traversal – unauthenticated attacker reads arbitrary files from RouterOS including the user database (/flash/rw/store/user.dat), extracting admin credentials in cleartext. Exploited to build the Meris botnet (~250,000 compromised routers generating 21.8 Mpps DDoS attacks against Yandex, 2021).
- 2CVE-2019-3943: Winbox authenticated path traversal – even after fixing CVE-2018-14847, authenticated users could write arbitrary files to the router filesystem, enabling persistent backdoor installation that survives firmware upgrades.
- 3CVE-2023-32154: RouterOS RADVD out-of-bounds write – unauthenticated attacker on the same network segment achieves code execution (Pwn2Own Toronto 2022). While not directly Winbox, compromised routers expose Winbox to all traffic.
- 4Default empty admin password: MikroTik ships with user 'admin' and NO password. Scanners find and compromise these within minutes of internet exposure. Meris botnet specifically targeted default-credential routers.
- 5Winbox protocol weaknesses: pre-RouterOS 6.43 Winbox authentication was vulnerable to replay attacks. Post-6.43 uses Elliptic Curve Diffie-Hellman but the protocol is proprietary and not independently audited.
Firewall guidance
Diagnosis commands
RouterOS: list all management services with their ports and allowed addresses
/ip service printCheck RouterOS version (must be 6.49.7+ or 7.x to be safe from known CVEs)
/system resource printDetect Winbox service and attempt version fingerprint from outside
nmap -sV -p 8291 --script banner targetVerify firewall rules protecting Winbox port
/ip firewall filter print where dst-port=8291Usage examples
/ip service set winbox port=8291 address=192.168.88.0/24
/ip service print (shows which services are enabled)
nmap -p 8291 --script banner targetCommon services on this port
Related ports
History
MikroTik was founded in Latvia in 1996. Winbox (port 8291) is their proprietary GUI management tool, first released with RouterOS in the early 2000s. The Winbox protocol is binary and undocumented – security researchers reverse-engineered it to discover CVE-2018-14847. The Meris botnet (2021) exploited this vulnerability on hundreds of thousands of unpatched routers, generating record DDoS attacks. MikroTik's massive ISP deployment base (millions of devices in developing markets) makes any Winbox vulnerability immediately critical at internet scale.
FAQ
How do I check if my MikroTik was compromised by Meris?
Check for: (1) Unknown scheduled scripts: /system scheduler print (Meris installs fetch scripts). (2) Unknown SOCKS proxy: /ip socks print (enabled = compromised). (3) Suspicious firewall rules: /ip firewall filter print, /ip firewall nat print (look for port forwards you didn't create). (4) Unknown users: /user print. Fix: update to latest RouterOS, reset config, change all passwords, disable unnecessary services.
Winbox vs WebFig vs SSH – which is safest?
SSH (port 22) is safest: standard protocol, auditable, key-based auth, encrypted. WebFig (port 80/443) is acceptable with HTTPS enabled and strong credentials. Winbox (port 8291) is convenient but uses a proprietary protocol with a history of vulnerabilities. For remote management, use WireGuard VPN + SSH. Use Winbox only on trusted LANs.