Internet-Security raven logo internet-security.com

TCP 8291

ProtocolTCP
Port8291
LabelsWinbox—Default on a MikroTik RouterOS

Synopsis

  • TCP port 8291 is the default port for MikroTik RouterOS “Winbox” management service (the proprietary GUI/protocol used by the Winbox client).
  • Real-world example: network admins and ISPs/WISPs use Winbox.exe to remotely configure MikroTik routers/switches (e.g., CCR, CRS, hAP) over TCP/8291.
  • This port has been heavily targeted: CVE-2018-14847 (Winbox directory traversal) was widely exploited to read RouterOS files (including user databases) and gain access.
  • Botnets and campaigns (including activity linked to VPNFilter-era attacks and widespread web-injection incidents on compromised MikroTik routers) have scanned and abused exposed 8291 services.

Observed activity

Last 30 days Detailed chart

More information