PT-2025-27771 · Mikrotik · Routeros

Published 2025-03-22 · Updated 2025-07-03 · CVE-2025-6563

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: MikroTik RouterOS versions prior to 7.19.2

Description: A cross-site scripting issue is present in the hotspot of MikroTik's RouterOS. An attacker can inject the javascript protocol in the dst parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim and triggers the payload.

Recommendations: For versions prior to 7.19.2, update to version 7.19.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the hotspot feature until a patch is applied. Avoid using the dst parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

BDU:2025-08273

CVE-2025-6563

Affected Products

Routeros

References · 7

• 🔥 https://exploit-db.com/exploits/52366 · Exploit
• 🔥 https://toreon.com/how-a-ski-trip-led-to-a-cve-in-a-wi-fi-hotspot · Exploit
• https://bdu.fstec.ru/vul/2025-08273 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6563 · Security Note
• https://twitter.com/ZeroDayCVE/status/1940753670242738558 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940839763382022605 · Twitter Post
• https://twitter.com/CVEnew/status/1940735036296429957 · Twitter Post