CVE-2025-61481

—

CVSS 3.1

10.0 critical

EPSS

<1%p21

Published

Oct 27, 2025 (Oct 27, 2025)

Modified

Jun 17, 2026

Description

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials.

Weakness: CWE-200, CWE-319, CWE-1188
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.