CVE-2025-25613

HighCVSS 7.5

Published: 20/11/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

In FS Inc S3150-8T2F switches before version 2.2.0D Build 135103, authentication credentials (usernames and passwords) are transmitted in cookies as cleartext, only encoded with base64. Every POST request to the administrative interface exposes these credentials in an unencrypted form.

Risk Assessment

Attackers can intercept network traffic and read administrator login credentials, leading to full compromise of the device and network. The lack of encryption allows easy theft of sensitive authentication data.

Recommendation

Immediately update the switch firmware to version 2.2.0D Build 135103 or later. Until the update is applied, restrict access to the administrative interface to trusted networks only.

Other vulnerabilities in FS Inc S3150-8T2F

CVE-2025-25612High
FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When saved, the script executes in the browser of any user accessing the affected page, including administrators.

Original NVD description (English source)

FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext using simple base64 encoding during every POST request made to the server.