{"id":"CVE-2025-6563","aliases":["EUVD-2025-19858","GHSA-gh3x-wfh2-9f86"],"status":"published","title":"Cross-site scripting via dst parameter in RouterOS WiFi hotspot","description":"A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00723,"percentile":0.54272,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2025-07-03T11:18:26Z","modified":"2026-06-17T10:02:09Z","exploits":[{"source":"exploitdb","id":"EDB-52366","title":"MikroTik RouterOS 7.19.1 - Reflected XSS","type":"remote","platform":"multiple","date":"2025-07-16","url":"https://www.exploit-db.com/exploits/52366"},{"source":"pocgithub","id":"praksokchea/CVE-2025-6563","title":"praksokchea/CVE-2025-6563","date":"2025-06-02","url":"https://github.com/praksokchea/CVE-2025-6563"}],"products":[{"vendor":"mikrotik","product":"routeros"}],"references":[{"url":"https://www.toreon.com/how-a-ski-trip-led-to-a-cve-in-a-wi-fi-hotspot/","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6563"},{"url":"https://www.toreon.com/how-a-ski-trip-led-to-a-cve-in-a-wi-fi-hotspot"},{"url":"https://github.com/advisories/GHSA-gh3x-wfh2-9f86"}],"sources":{"cve":[{"id":"CVE-2025-6563","title":"Cross-site scripting via dst parameter in RouterOS WiFi hotspot","description":"A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.","status":"published","published":"2025-07-03T11:18:26.211Z","modified":"2025-07-03T13:17:13.946Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:40.419293Z"}],"euvd":[{"id":"EUVD-2025-19858","description":"A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.","status":"published","published":"2025-07-03T11:18:26Z","modified":"2025-07-03T13:17:13Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:32:14.284181Z"}],"ghsa":[{"id":"GHSA-gh3x-wfh2-9f86","title":"A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions...","description":"A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.","status":"published","published":"2025-07-03T12:34:58Z","modified":"2025-07-03T12:35:10Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:02:53.892162Z"}],"nvd":[{"id":"CVE-2025-6563","description":"A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.","status":"published","published":"2025-07-03T12:15:25.077Z","modified":"2026-06-17T10:02:09.427Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:11:15.754475Z"}]}}