External risk intelligence

MikroTik WebFig Cleartext HTTP Disclosure Allows JavaScript Injection and Credential Interception

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-61481

The vulnerability resides in the WebFig management interface of networking equipment. This interface is designed to be accessible for administrative purposes and is commonly exposed to the network, often including the public internet in edge router or switch deployments, making it a primary management surface that is public-facing by design in many real-world configurations.

Information Disclosure

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue has been identified in MikroTik RouterOS and SwOS that could allow an attacker to inject malicious JavaScript and intercept credentials by exploiting the cleartext HTTP transmission of the WebFig management interface.

Management interface exposed over plain text.
High impact if network credentials are stolen.
Confirm relevance and exposure to sensitive systems.

Attack Path

How an attacker could exploit the issue

An attacker positioned between the administrator and the management interface can exploit this vulnerability by sending specially crafted JavaScript. This can occur because the management interface is exposed using unencrypted HTTP by default, allowing the attacker to inject malicious code that runs in the administrator's browser. This could lead to the theft of administrator credentials and other sensitive information.

No authentication or special access needed.
Injected JavaScript in management interface.
Intercept credentials and execute code.

Live Threat

Current exploitation, exposure, and threat context

The WebFig management interface, when exposed over cleartext HTTP, could allow an on-path attacker to inject JavaScript into an administrator's browser. This could enable the attacker to intercept sensitive credentials when they are entered.

Administrator credentials and session tokens.
On-path attacker intercepts HTTP traffic.
Credentials and session can be stolen.

Operational Fix

Recommended remediation, mitigation, and detection steps

The responsibility for addressing this vulnerability likely falls to infrastructure and network teams managing MikroTik devices, with potential coordination from security operations for exposure review. The first practical step involves identifying all deployed MikroTik devices running the affected software, assessing their network exposure, and determining business criticality to prioritize remediation efforts.

Infrastructure and network teams own remediation.
Verify device exposure and asset inventory.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MikroTik RouterOS and SwOS?

These are the core operating systems for MikroTik networking hardware. RouterOS powers high-performance routers and wireless equipment, while SwOS is a lightweight system designed for switches. They provide the WebFig management interface, a web-based dashboard that administrators use to configure network settings, monitor traffic, and manage device security policies across enterprise and home networks.

How does CVE-2025-61481 allow data interception?

This vulnerability involves the use of unencrypted HTTP for the WebFig interface, which falls under CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-200 (Exposure of Sensitive Information). Because the traffic is not protected by encryption, an attacker can read the data stream. This allows them to inject malicious JavaScript into the administrator's browser, which can then be used to capture login credentials and session tokens as they are transmitted.

Do I need special access to trigger this bug?

No, an attacker does not need prior authentication or elevated privileges. The vulnerability is triggered by an 'on-path' attacker, meaning someone who can intercept network traffic between the administrator and the device. This does not trigger if the management traffic is restricted to a secure, encrypted tunnel or if the administrator is accessing the device through a VPN or an already encrypted management channel.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies this as a high-relevance issue because WebFig is a management interface often left exposed on network edges. If your MikroTik device is directly reachable from the public internet or is positioned on a segment where traffic can be intercepted, it faces a significantly higher risk of exploitation compared to devices strictly isolated on internal management-only networks.

What should I do first to address this?

Start by identifying all MikroTik devices in your environment running the affected versions. Inventory these assets to see which are accessible over the network. Your primary goal is to limit the management interface's exposure by restricting access to authorized IP ranges or ensuring all management traffic is forced through secure, encrypted connections rather than relying on the default cleartext HTTP configuration.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.