MikroTik RouterOS WebFig Authentication Data

The vulnerability of the WebFig web interface in MikroTik RouterOS and SwitchOS lies in the transmission of credentials in an unencrypted form. Exploiting this vulnerability allows a remote attacker to obtain authentication data by sending specially crafted HTTP requests...

CVE-2025-61481

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials...

EUVD-2025-36192

An issue in MikroTik RouterOS v.7.14.2 and SwitchOS v.2.18 allows a remote attacker to execute arbitrary code via the HTTP- only WebFig management component...

CVE-2025-61481

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials...

CVE-2025-61481

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials...

CVE-2025-61481

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials...

MikroTik RouterOS and MikroTik RouterOS 7 security vulnerabilities

MikroTik RouterOS and MikroTik RouterOS 7 are both products of the Latvian company MikroTik.MikroTik RouterOS is a router operating system developed on Linux. The system can be deployed in a PC to make it provide router functionality.MikroTik RouterOS 7 is an operating system... A security...

CVE-2025-61481

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default. This configuration flaw allows an on-path attacker to intercept credentials or execute injected JavaScript in the administrator's browser. Furthermore, the vulnerability ...

PT-2025-43960

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS version 7.14.2 MikroTik SwitchOS version 2.18 Description An issue exists in MikroTik RouterOS and SwitchOS where the WebFig management interface is exposed over cleartext HTTP by default. This allows a remote attacker to...