CVE-2025-25613

{
  "id": "CVE-2025-25613",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-20T21:16:02.310",
  "lastModified": "2026-11-05T13:10:00.180",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext using simple base64 encoding during every POST request made to the server."
    },
    {
      "lang": "es",
      "value": "FS Inc S3150-8T2F Switch L2+ Gigabit Ethernet de 8 puertos, 8 x Gigabit RJ45, con 2 x SFP de 1Gb, sin ventilador. Se descubrió que todas las versiones anteriores a la 2.2.0D Build 135103 transmitían cookies para su aplicación administrativa basada en web que contenían nombres de usuario y contraseñas. Estas se transmitían en texto claro utilizando una codificación base64 simple durante cada solicitud POST realizada al servidor."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-21T14:36:36.697819Z",
          "id": "CVE-2025-25613",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fs:s3150-8t2f_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.2.0D",
              "matchCriteriaId": "F70E4EAB-4BF6-43BA-A9C2-A88CAB42A248"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:fs:s3150-8t2f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "45F236EE-F0B3-4D72-9F5C-E5282B6D0F5D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/SwiftSecur/S3150-8T2F-FS.com-Research/wiki",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}