CVE-2025-61481 - Vulnerability Details - OpenCVE

An issue in MikroTik RouterOS v.7.14.2 and SwitchOS v.2.18 allows a remote attacker to execute arbitrary code via the HTTP- only WebFig management component

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Mikrotik	Routeros Switchos

No data.

No data.

References

Link	Providers
https://help.mikrotik.com/docs/spaces/ROS/pages/328131/WebFig
https://help.mikrotik.com/docs/spaces/SWOS/pages/328415/SwOS
https://svarthatt.se/cve/mikrotik-swos-cve-2025-61481/

History

Mon, 27 Oct 2025 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mikrotik Mikrotik routeros Mikrotik switchos
Vendors & Products		Mikrotik Mikrotik routeros Mikrotik switchos

Mon, 27 Oct 2025 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1188 CWE-200 CWE-319
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 27 Oct 2025 14:00:00 +0000

Type	Values Removed	Values Added
Description		An issue in MikroTik RouterOS v.7.14.2 and SwitchOS v.2.18 allows a remote attacker to execute arbitrary code via the HTTP- only WebFig management component
References		https://help.mikrotik.com/docs/spaces/ROS/pages/328131/WebFig https://help.mikrotik.com/docs/spaces/SWOS/pages/328415/SwOS https://svarthatt.se/cve/mikrotik-swos-cve-2025-61481/

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-10-27T00:00:00.000Z

Updated: 2025-10-27T15:56:59.089Z

Reserved: 2025-09-26T00:00:00.000Z

Link: CVE-2025-61481

Vulnrichment

Updated: 2025-10-27T15:50:04.982Z

NVD

Status : Received

Published: 2025-10-27T14:15:41.410

Modified: 2025-10-27T16:15:42.943

Link: CVE-2025-61481

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-61481", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-10-27T15:56:59.089Z", "dateReserved": "2025-09-26T00:00:00.000Z", "datePublished": "2025-10-27T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-10-27T13:54:54.104Z"}, "descriptions": [{"lang": "en", "value": "An issue in MikroTik RouterOS v.7.14.2 and SwitchOS v.2.18 allows a remote attacker to execute arbitrary code via the HTTP- only WebFig management component"}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://help.mikrotik.com/docs/spaces/ROS/pages/328131/WebFig"}, {"url": "https://help.mikrotik.com/docs/spaces/SWOS/pages/328415/SwOS"}, {"url": "https://svarthatt.se/cve/mikrotik-swos-cve-2025-61481/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1188", "lang": "en", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-319", "lang": "en", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T15:50:10.543086Z", "id": "CVE-2025-61481", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:56:59.089Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-61481", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-27T15:50:10.543086Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:50:04.982Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://help.mikrotik.com/docs/spaces/ROS/pages/328131/WebFig"}, {"url": "https://help.mikrotik.com/docs/spaces/SWOS/pages/328415/SwOS"}, {"url": "https://svarthatt.se/cve/mikrotik-swos-cve-2025-61481/"}], "descriptions": [{"lang": "en", "value": "An issue in MikroTik RouterOS v.7.14.2 and SwitchOS v.2.18 allows a remote attacker to execute arbitrary code via the HTTP- only WebFig management component"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-10-27T13:54:54.104Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61481", "state": "PUBLISHED", "dateUpdated": "2025-10-27T15:56:59.089Z", "dateReserved": "2025-09-26T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-10-27T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}