CVE-2025-25613
📋 TL;DR
The FS Inc S3150-8T2F switch transmits administrative credentials in cleartext via base64-encoded cookies during every POST request to the web interface. This allows attackers with network access to intercept and decode administrator usernames and passwords. All organizations using affected versions of this switch are vulnerable.
💻 Affected Systems
- FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full network compromise where attackers gain administrative access to the switch, enabling them to reconfigure network settings, intercept traffic, or use the switch as a pivot point to attack other systems.
Likely Case
Attackers capture administrative credentials and gain unauthorized access to the switch's management interface, potentially disrupting network operations or conducting further reconnaissance.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential credential exposure without lateral movement opportunities.
🎯 Exploit Status
Exploitation requires network access to intercept HTTP traffic. Attackers can use tools like Wireshark or Burp Suite to capture and decode base64 credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.0D Build 135103 or later
Vendor Advisory: http://fs.com
Restart Required: Yes
Instructions:
1. Download firmware version 2.2.0D Build 135103 or later from FS Inc website. 2. Log into switch web interface. 3. Navigate to System > Firmware Upgrade. 4. Upload the new firmware file. 5. Reboot the switch after upgrade completes.
🔧 Temporary Workarounds
Disable HTTP web interface
allDisable the vulnerable HTTP web interface and use HTTPS or console/SSH management only
configure terminal
no ip http server
ip http secure-server
end
write memory
Restrict management interface access
allApply access control lists to restrict access to the management interface
configure terminal
access-list 10 permit [trusted_network]
interface vlan 1
ip access-group 10 in
end
write memory
🧯 If You Can't Patch
- Isolate switch management interface on a dedicated VLAN with strict access controls
- Implement network monitoring to detect credential interception attempts and unauthorized access
🔍 How to Verify
Check if Vulnerable:
Capture network traffic to the switch's web interface during login or any POST request, then decode base64 values in cookie headers to check for credentials.Check Version:
show version (via CLI) or check System Information in web interfaceVerify Fix Applied:
After patching, verify that cookies no longer contain base64-encoded credentials and that HTTPS is properly implemented.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login from unusual IP
- Administrative configuration changes from unexpected sources
Network Indicators:
- Unencrypted HTTP traffic to switch management interface containing base64 strings in cookies
- Traffic interception tools like Wireshark or tcpdump targeting switch IP
SIEM Query:
source_ip="switch_ip" AND (http.cookie CONTAINS "base64" OR http.cookie CONTAINS "Authorization=")