WEAK ENCODING FOR PASSWORD IN DEVICE SERVER CONFIGURATION
Summary
| CVE | CVE-2025-11155 |
|---|---|
| State | PUBLISHED |
| Assigner | S21sec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-09-29 16:15:37 UTC |
| Updated | 2026-10-09 09:10:00 UTC |
| Description | The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials. |
Risk And Classification
Primary CVSS: v4.0 6.8 MEDIUM from 50b5080a-775f-442e-83b5-926b5ca517b6
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.001920000 probability, percentile 0.081450000 (date 2026-10-11)
Problem Types: CWE-261 | CWE-261 CWE-261: Weak Encoding for Password
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 50b5080a-775f-442e-83b5-926b5ca517b6 | Secondary | 6.8 | MEDIUM | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.8 | MEDIUM | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | SATO | S86-ex 203dpi | affected 61.00.00.09 Firmware | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.s21sec.com/cvelist | 50b5080a-775f-442e-83b5-926b5ca517b6 | www.s21sec.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Víctor Bello Cuevas (en)
CNA: Aarón Flecha Menéndez (en)
CNA: Iván Alonso Álvarez (en)
Additional Advisory Data
Solutions
CNA: It is recommended to update the device to version 61.00.01.03
CNA: https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsatoamerica.zendesk.com%2Fattachments%2Ftoken%2FrLRv8O2cYIlh18ognpVd3Kz23%2F%3Fname%3DFirmware_Download_Procedure_S84ex_S86ex.pdf&data=05%7C02%7Ccve-coordination%40s21sec.com%7Ca965b77467c04de8ddff08ddfea85958%7C3954031c8b0f4b409c0d3504f88641f5%7C0%7C0%7C638946721357023256%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=QSuXeD7kLAH02F0kMEqvCba5zD2FfQ%2FXWuHsTAy1XiA%3D&reserved=0