# WHATPORT(8291)

## NAME

port 8291 — MikroTik WinBox — The management port for MikroTik RouterOS — WinBox, the vendor's GUI admin tool.

Protocol: TCP

## DESCRIPTION

RouterOS exposes a set of management services under /ip service, and the winbox service defaults to TCP 8291; the WinBox application connects there to configure the router. MikroTik's own docs list the default as 8291 and note the port is changeable in the services menu. An open 8291 on a public IP is a router admin plane, and it has been mass-exploited: CVE-2018-14847 let an attacker connected to the WinBox port read the system user database, and MikroTik's advisory tells operators to assume compromise if the port faced untrusted networks. Internet scans still find large numbers of these, which is why 8291 is a standard sweep target.

## EXPOSURE

**Do not expose.** This is a router's administrative interface with a history of pre-auth file disclosure. Firewall it to a management network or VPN; MikroTik's own guidance is to block it from public interfaces.

## CHECK

```sh
nc -vz TARGET 8291
```

## SEE ALSO

- docs — [MikroTik RouterOS — Services (default ports incl. winbox 8291)](https://help.mikrotik.com/docs/spaces/ROS/pages/103841820/Services) (help.mikrotik.com)
- docs — [MikroTik RouterOS — WinBox](https://help.mikrotik.com/docs/spaces/ROS/pages/328129/WinBox) (help.mikrotik.com)
- docs — [MikroTik security advisory — Winbox vulnerability (CVE-2018-14847)](https://mikrotik.com/supportsec/winbox-vulnerability/) (mikrotik.com)

---

HTML: <https://whatport.net/8291/> · JSON: <https://whatport.net/8291.json> · full dataset: <https://whatport.net/ports.json>