CVE-2025-11155 — WEAK ENCODING FOR PASSWORD IN DEVICE SERVER CONFIGURATION
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercep…
Published: 2025-09-29 · CVSS: 6.8 · CVSS 4.0
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7