The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials.

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0003.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-31580 The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials.
Fixes

Solution

It is recommended to update the device to version  61.00.01.03

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.s21sec.com/cvelist/ cve-icon cve-icon
History

Mon, 29 Sep 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Sep 2025 15:45:00 +0000

Type Values Removed Values Added
References

Mon, 29 Sep 2025 15:30:00 +0000

Type Values Removed Values Added
Description The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials.
Title WEAK ENCODING FOR PASSWORD IN DEVICE SERVER CONFIGURATION
Weaknesses CWE-261
References
Metrics cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: S21sec

Published:

Updated: 2025-11-03T12:02:51.688Z

Reserved: 2025-09-29T14:16:25.728Z

Link: CVE-2025-11155

cve-icon Vulnrichment

Updated: 2025-09-29T15:23:54.475Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-29T16:15:37.223

Modified: 2025-09-29T19:34:10.030

Link: CVE-2025-11155

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.