CVE-2025-6563

🗓️ 03 Jul 2025 11:18:26Reported by ToreonType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 51 Views🌐 WEB

Cross-site scripting vulnerability in MikroTik RouterOS hotspot allows attacker login exploits.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-6563	3 Jul 202515:08	–	circl
CNNVD	MikroTik RouterOS 安全漏洞	3 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-6563 Cross-site scripting via dst parameter in RouterOS WiFi hotspot	3 Jul 202511:18	–	cvelist
Exploit DB	MikroTik RouterOS 7.19.1 - Reflected XSS	16 Jul 202500:00	–	exploitdb
EUVD	EUVD-2025-19858	3 Oct 202520:07	–	euvd
NVD	CVE-2025-6563	3 Jul 202512:15	–	nvd
OpenVAS	MikroTik RouterOS 7.x < 7.19.2 XSS Vulnerability	25 Jul 202500:00	–	openvas
Packet Storm	📄 MikroTik RouterOS 7.19.1 Cross Site Scripting	16 Jul 202500:00	–	packetstorm
Positive Technologies	PT-2025-27771 · Mikrotik · Routeros	22 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-6563	5 Jul 202511:22	–	redhatcve

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Hotspot"
    ],
    "product": "RouterOS",
    "vendor": "MikroTik",
    "versions": [
      {
        "lessThan": "7.19.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
toreon	www.toreon.com/how-a-ski-trip-led-to-a-cve-in-a-wi-fi-hotspot/

Parameter	Position	Path	Description	CWE
dst	query param	login?dst=javascript:alert(3)	Reflected XSS via dst parameter in login flow (CVE-2025-6563)	CWE-20

15 Apr 2026 00:35Current

5.4Medium risk

Vulners AI Score5.4

CVSS 44.8

EPSS0.0149

SSVC

CWE-20