The management port for MikroTik RouterOS — WinBox, the vendor's GUI admin tool.
RouterOS exposes a set of management services under /ip service, and the winbox service defaults to TCP 8291; the WinBox application connects there to configure the router. MikroTik's own docs list the default as 8291 and note the port is changeable in the services menu. An open 8291 on a public IP is a router admin plane, and it has been mass-exploited: CVE-2018-14847 let an attacker connected to the WinBox port read the system user database, and MikroTik's advisory tells operators to assume compromise if the port faced untrusted networks. Internet scans still find large numbers of these, which is why 8291 is a standard sweep target.
Do not expose
This is a router's administrative interface with a history of pre-auth file disclosure. Firewall it to a management network or VPN; MikroTik's own guidance is to block it from public interfaces.
$ nc -vz TARGET 8291Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.