CVE-2025-61481# 🚨 **CVE-2025-61481 — Critical MikroTik WebFig Vulnerability (RCE + Credential Exposure)**
🕒 Published: 2025 | 💣 CVSS 10.0 (Critical) | 🌐 Affects: RouterOS v7.14.2 & SwitchOS v2.18
---
### 🧩 Overview
A newly disclosed vulnerability, **CVE-2025-61481**, impacts **MikroTik RouterOS (v7.14.2)** and **SwitchOS (v2.18)**.
The issue lies in the **WebFig** management interface, which by default uses **HTTP (unencrypted)** instead of HTTPS.
This configuration sends login credentials and session data in cleartext — allowing attackers on the same network (or a man-in-the-middle position) to intercept, manipulate, and potentially gain **remote code execution (RCE)** on affected devices.
---
### ⚠️ Severity
- **CVSS v3.1 Base Score:** 10.0 — _Critical_
- **Vector:** `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L`
- **Impact:** Complete takeover of device management, credential theft, and configuration tampering.
---
### 🔍 Technical Summary
- WebFig defaults to **HTTP (port 80)** without automatic HTTPS redirection.
- Credentials are stored in **sessionStorage** and transmitted unencrypted.
- Traffic interception enables credential harvesting or session hijacking.
- Once authenticated, attackers may execute arbitrary commands on the device.
---
### 🧠 Attack Scenario
1. An attacker on the same network performs a **MitM** attack (e.g., ARP spoofing).
2. The victim logs into WebFig via HTTP.
3. Credentials are captured in transit.
4. Attacker logs into the router, executes arbitrary commands, or changes configs remotely.
---
### 🛡️ Mitigation & Defense
✅ **1. Disable HTTP** — Enable and enforce **HTTPS** on WebFig.
✅ **2. Restrict Management Access** — Limit to a trusted admin VLAN or IP range.
✅ **3. Use Encrypted Channels** — Prefer **SSH** or **VPN tunnels** for administration.
✅ **4. Monitor Logs** — Watch for unusual logins or port 80 traffic.
✅ **5. Patch Immediately** — Apply MikroTik’s firmware update once released.
---
### 🧭 Recommendations
If you’re managing MikroTik devices:
- Audit your routers/switches today.
- Force HTTPS for all WebFig access.
- Review your device firewall to block external HTTP management traffic.
---
### 🗣️ Closing Note
This CVE is a strong reminder that **“default” ≠ “secure.”**
Even robust platforms like MikroTik can expose critical surfaces when encryption isn’t enforced by default.
🔒 Always assume unencrypted management = compromised credentials.
[4.0K] /data/pocs/746e9ee42bc603884582410e262ae8a73379a98d
└── [2.6K] README.md
1 directory, 1 file