kerma

This repository is an exploit toolkit for a critical vulnerability in Mikrotik RouterOS Winbox. The vulnerability is present in all versions from 6.29 to 6.42. The toolkit includes several scripts and tools to exploit the vulnerability and extract user credentials. The PoC.py script is the main...

PT-2025-39377

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS version 7 Description A buffer overflow issue exists in MikroTik RouterOS 7. The issue is located in the parse json element function within the libjson.so component, specifically accessible through the /rest/ip/address/print...

Exploit for Path Traversal in Mikrotik Routeros

This is a PoC exploit for CVE-2018-14847 targeting RouterOS-based routers. The tool, named Meris RouterOS Checker, checks a list of IP addresses to validate if they were infected with Meris. It uses the RouterOS API, SSH, and WinBox to connect to the routers and attempt to exploit the...

The vulnerability of the application software interface of the RouterOS operating system for MikroTik routers allows a hacker to gain access to resources within the internal network.

The vulnerability of the RouterOS application programming interface of MikroTik routers is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to gain access to internal network resources remotely...

Exploit for CVE-2024-27686

CVE-2024-27686: RouterOS-SMB-DOS-POC Update As of 3/4/24 Mit...

MikroTik RouterOS 6.44 / 6.49.10 Denial of Service

MikroTik RouterOS versions 6.40.5 through 6.44 and 6.48.1 through 6.49.10 SMB denial of service exploit...

Exploit for Path Traversal in Mikrotik Routeros

Ladon Scanner For Golang Wiki http://k8gege.org/Ladon/LadonGo.html Introduction LadonGo is an open source intranet penetration scanner framework, which can be used to easily detect segment C, B, A live hosts, fingerprint identification, port scanning, password explosion, remote execution, high-ri...

Exploit for CVE-2024-27686

MikroTik RouterOS Denial of Service Vulnerability 📌 Descri...

MikroTik RouterOS <= 7.19.3 Access Control Vulnerability

MikroTik RouterOS is prone to an access control vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:mikrotik:routeros"...

MikroTik RouterOS < 6.49.13, 7.x < 7.14 IPv6 Vulnerability

MikroTik RouterOS is prone to a vulnerability in the IPv6 firewall rule. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MikroTik RouterOS 7.x < 7.19.2 XSS Vulnerability

MikroTik RouterOS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

📄 MikroTik RouterOS 7.19.1 Cross Site Scripting

MikroTik RouterOS versions 7.19.1 and below suffer from a cross site scripting vulnerability. Exploit Title: MikroTik RouterOS 7.19.1 - Reflected XSS Google Dork: inurl:/login?dst= Date: 2025-07-15 Exploit Author: Prak Sokchea Vendor Homepage: https://mikrotik.com Software Link:...

MikroTik RouterOS 7.19.1 - Reflected XSS

Exploit Title: MikroTik RouterOS 7.19.1 - Reflected XSS Google Dork: inurl:/login?dst= Date: 2025-07-15 Exploit Author: Prak Sokchea Vendor Homepage: https://mikrotik.com Software Link: https://mikrotik.com/download Version: RouterOS /login?dst=javascript:alert3 A reflected XSS will be triggered...

The vulnerability of the RouterOS operating system for MikroTik routers, related to insufficient validation of input data, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the RouterOS operating system for MikroTik routers is related to insufficient validation of input data when processing the dst parameter. Exploiting this vulnerability allows a malicious actor to perform domain-based scenario attacks remotely...

📄 MikroTik RouterOS Cross Site Scripting

A reflected cross site scripting vulnerability exists in MikroTik RouterOS versions prior to version 7, specifically in the UserManager web interface. This flaw can be exploited by unauthenticated attackers, allowing JavaScript injection via a specially crafted URL without requiring a valid login...

CVE-2025-6563

A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the javascript protocol in the dst parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also...

CVE-2025-6563

A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the javascript protocol in the dst parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also...

CVE-2025-6563 Cross-site scripting via dst parameter in RouterOS WiFi hotspot

A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the javascript protocol in the dst parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also...

CVE-2025-6563

MikroTik RouterOS has a cross-site scripting (XSS) vulnerability in the hotspot component for versions below 7.19.2. The issue stems from improper handling of the destination URL parameter (dst), allowing an attacker to inject a javascript: payload. When a user visits the crafted login URL and au...

CVE-2025-6563 Cross-site scripting via dst parameter in RouterOS WiFi hotspot

A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the javascript protocol in the dst parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also...