CVE-2025-61481: MikroTik RouterOS · Insecure Default
Source CVE Database V5
Not known to be exploited · CVSS 10.0 Critical.
Data as of 26 Oct 2026, 11:42 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 21% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LExploitation evidence
Disclosed: evidence found.
CVE published 27 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-61481, European organizations should immediately disable HTTP access to the WebFig management interface on all affected MikroTik RouterOS and SwOS devices. Administrators must enforce HTTPS-only access for device management to ensure encrypted communication. Where possible, update devices to vendor-released patched versions once available. If patches are not yet released, consider temporary workarounds such as restricting management interface access to trusted internal networks or VPNs, and implementing strict network segmentation to isolate management traffic. Deploy network intrusion detection systems (NIDS) to monitor for suspicious HTTP traffic or injection attempts targeting the WebFig interface. Regularly audit device configurations to ensure no fallback to HTTP occurs. Educate network administrators about the risks of using unencrypted management interfaces and encourage use of strong, unique credentials combined with multi-factor authentication if supported. Finally, maintain up-to-date asset inventories to quickly identify and remediate vulnerable devices across the organization.
Description
An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials.