CVE-2025-61481: MikroTik RouterOS/SwOS XSS Vulnerability

CVE-2025-61481 Overview

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator's browser and intercept credentials. This insecure default configuration vulnerability enables man-in-the-middle attacks where attackers positioned on the network path can inject malicious scripts and capture sensitive authentication data.

Critical Impact

On-path attackers can inject arbitrary JavaScript into administrator browser sessions and intercept credentials due to cleartext HTTP exposure of the WebFig management interface.

Affected Products

• MikroTik RouterOS v.7.14.2
• MikroTik SwOS v.2.18
• MikroTik devices with WebFig management interface enabled

Discovery Timeline

• 2025-10-27 - CVE-2025-61481 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2025-61481

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The WebFig management interface, which provides a web-based GUI for configuring MikroTik RouterOS and SwOS devices, is exposed over cleartext HTTP by default. This fundamental security misconfiguration creates a significant attack surface where any attacker with network visibility can observe and manipulate traffic between administrators and their network devices.

The lack of TLS encryption on the management interface means that all data transmitted—including administrative credentials, configuration changes, and session tokens—travels across the network in plaintext. This allows on-path attackers to not only passively intercept credentials but also actively inject malicious JavaScript code into HTTP responses served by the WebFig interface.

Root Cause

The root cause of this vulnerability is an insecure default configuration in MikroTik RouterOS and SwOS. The WebFig management interface does not enforce HTTPS by default, leaving the critical administrative channel unprotected. Network infrastructure devices are high-value targets, and exposing their management interfaces over HTTP violates fundamental security principles for administrative access.

Attack Vector

The attack vector is network-based, requiring the attacker to be positioned on the network path between the administrator and the MikroTik device. This could be achieved through ARP spoofing, DNS hijacking, compromised network infrastructure, or physical access to network segments. Once in position, the attacker can perform man-in-the-middle attacks to:

1. Credential Interception: Capture administrator usernames and passwords transmitted in cleartext during login
2. JavaScript Injection: Modify HTTP responses to inject malicious JavaScript that executes in the administrator's browser context
3. Session Hijacking: Capture session cookies or tokens to impersonate authenticated administrators
4. Configuration Manipulation: Modify configuration commands in transit to alter device settings

The vulnerability does not require any privileges or user interaction beyond normal administrative access to the device. An attacker successfully exploiting this vulnerability could gain complete control over affected network infrastructure devices.

Detection Methods for CVE-2025-61481

Indicators of Compromise

• Unexpected HTTP traffic on port 80 to MikroTik device management interfaces from internal network segments
• ARP spoofing or cache poisoning indicators on network segments where MikroTik devices are managed
• Anomalous JavaScript content in HTTP responses from MikroTik WebFig interfaces
• Login failures followed by successful authentication from different source IPs

Detection Strategies

• Monitor network traffic for cleartext HTTP sessions to MikroTik device management interfaces using network intrusion detection systems
• Implement network segmentation monitoring to detect unauthorized access to management network segments
• Deploy SentinelOne agents on administrator workstations to detect malicious JavaScript execution patterns
• Configure alerts for authentication anomalies on MikroTik devices through syslog monitoring

Monitoring Recommendations

• Enable comprehensive logging on MikroTik devices and forward logs to a centralized SIEM solution
• Monitor for configuration changes made through the WebFig interface, especially from unexpected source addresses
• Implement network traffic analysis to identify potential man-in-the-middle attack indicators
• Review administrator access patterns regularly to identify potential credential compromise

How to Mitigate CVE-2025-61481

Immediate Actions Required

• Enable HTTPS on the WebFig management interface and disable HTTP access immediately
• Restrict management interface access to dedicated management VLANs with strict access controls
• Implement certificate-based authentication for administrative access where supported
• Audit recent administrative sessions for signs of compromise or unauthorized configuration changes

Patch Information

Organizations should update to the latest versions of MikroTik RouterOS and SwOS that address this insecure default configuration. Refer to the MikroTik WebFig Documentation and MikroTik SwOS Documentation for guidance on enabling secure HTTPS access. Additional technical analysis is available from the Svarthatt CVE-2025-61481 Analysis.

Workarounds

• Configure the WebFig interface to listen only on HTTPS (port 443) and disable HTTP (port 80) access
• Place MikroTik management interfaces on isolated management networks not accessible from general user segments
• Use VPN tunnels for remote administrative access to ensure encryption of management traffic
• Implement network access controls to restrict which hosts can reach management interfaces

# Configuration example - Enable HTTPS and disable HTTP on MikroTik RouterOS
# Access via SSH or console and execute:

/ip service set www disabled=yes
/ip service set www-ssl address=192.168.88.0/24 disabled=no
/certificate add name=webfig-cert common-name=router.local days-valid=365
/ip service set www-ssl certificate=webfig-cert