We tested the vulnerability CVE-2025-6563, a reflected Cross-Site Scripting (XSS) present in the hotspot functionality of MikroTik RouterOS. The goal was to verify whether it was possible to inject the javascript: protocol into the dst parameter of the login page to execute malicious code in the authenticated user’s browser. We analyzed two vectors: one that requires the victim to enter credentials (POST) and one that exploits the conversion of the request to GET to perform an automatic login without additional interaction.
The test was conducted on a CHR (Cloud Hosted Router) with x86_64 architecture, running RouterOS 7.19.1. The topology featured a MikroTik hotspot configured on VLAN744 guest (10.74.4.0/24) with the captive portal active. For testing, a hotspot user test with password test was created. Subsequently, we verified the behavior on an updated version running RouterOS 7.24.5 to confirm the effectiveness of the patch.
This content is reserved for those in the dojo.
Entry is free: you subscribe to the newsletter with your email and then choose to join the dojo, without a password. How it works
