CVE-2025-6563: Cross-site scripting via dst parameter in RouterOS WiFi hotspot
A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the javascript protocol in the dst parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MikroTik RouterOS hotspotto a version that resolves this vulnerability.Fixed in 7.19.2 - Compensating control
Restrict access to the MikroTik RouterOS WiFi hotspot (hotspot/login interface) using network isolation/ACL/firewall so only trusted clients can reach it while patching.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6563?
The severity of CVE-2025-6563 is classified as medium due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-6563?
To mitigate CVE-2025-6563, upgrade MikroTik RouterOS to version 7.19.2 or later.
What vulnerabilities are related to CVE-2025-6563?
CVE-2025-6563 is related to other XSS vulnerabilities found in RouterOS prior to version 7.19.2.
Who is affected by CVE-2025-6563?
Users of MikroTik RouterOS on versions prior to 7.19.2 are affected by CVE-2025-6563.
What is the impact of CVE-2025-6563?
The impact of CVE-2025-6563 includes the possibility of attackers executing arbitrary JavaScript in the victim's browser session.