Critical MikroTik Flaw (CVE-2025-61481, CVSS 10.0) Exposes Router Admin Credentials Over Unencrypted HTTP WebFig

A newly disclosed vulnerability, CVE-2025-61481, rated CVSS 10.0, affects MikroTik RouterOS 7.14.2 and SwOS 2.18 and allows remote attackers to execute arbitrary code or intercept credentials via the WebFig management interface, which runs over HTTP by default. According to the report, MikroTik RouterOS through version 7.14.2 and SwOS through version 2.18 initialise the WebFig management interface with HTTP enabled by default and without automatic redirection to HTTPS.

The issue was uncovered by security researcher Oliver Bölin, who showed that after a factory reset affected devices serve the entire management UI, including the login page, over cleartext HTTP, exposing credentials to anyone on the local network. During authentication, the WebFig browser-side JavaScript stores credentials in window.sessionStorage and transmits them unencrypted over port 80, enabling man-in-the-middle attacks on the local network.

If exploited, attackers could harvest admin credentials, alter routing or firewall rules, or implant persistent scripts for remote code execution. The advisory suggests restricting WebFig access to trusted networks, enabling HTTPS in WebFig, and using encrypted management alternatives such as SSH or VPNs.