CVE-2025-6563 Cross-site scripting via dst parameter in RouterOS WiFi hotspot
Attackers can execute arbitrary JavaScript in victim browsers via the dst parameter in MikroTik RouterOS WiFi hotspot, potentially hijacking sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-6563?
CVE-2025-6563 is a medium-severity cross-site scripting vulnerability in MikroTik RouterOS, published on 3 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.
Weakness: CWE-20
Which versions are affected by CVE-2025-6563?
How do I fix CVE-2025-6563?
No fix has been published for CVE-2025-6563 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-6563 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6563 exists.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-gh3x-wfh2-9f86.