Credentials used to log in to the device's web server are transmitted in base64 encoded form within HTTP headers. Because base64 is merely an encoding mechanism and not a form of encryption, an adversary can capture these headers and decode them, thereby learning valid usernames and passwords. The disclosed credentials allow the attacker to authenticate to the device, potentially gaining full administrative control. This flaw is a classic example of credential storage or transmission weaknesses, as identified by CWE‑261.

The vulnerability applies to the EFACEC QC 60, QC 90, and QC 120 series of network security devices. No specific firmware versions are recorded in the CNA data, so all firmware builds running these hardware models could be susceptible until a vendor patch or other mitigation is applied.

The CVSS score of 6.9 marks the flaw as a medium severity issue, while the EPSS value of less than 1% indicates that exploitation is considered unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is passive eavesdropping on unencrypted HTTP traffic to the device's web interface or active interception if the device is exposed on a network that can be accessed by an attacker. Because the credentials are sent in plain headers, the attack does not require privileged access to the device; capturing the traffic on the same LAN or through a man‑in‑the‑middle position suffices to compromise authentication.