ID: MEDIUM-11

Title: Web interface served over unencrypted HTTP

Severity: Medium

CVSS Score: 6.5

CVSS Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description: The web management interface is served exclusively over HTTP with no HTTPS support, as OpenSSL and TLS libraries are absent from the device. This has several direct security consequences. First, HTTP Basic Authentication credentials are transmitted in every request via the Authorization header as a Base64-encoded string decoding to admin:<password_hash>. Base64 is a trivially reversible encoding that provides no confidentiality. Second, sensitive form submissions such as password changes are transmitted as HTTP GET requests with all parameters appended to the URL, exposing them in browser history, server access logs, and Referer headers sent to subsequently loaded resources. Although passwords are MD5-hashed and Base64-encoded client-side before transmission, MD5 is not a secure transport protection mechanism and the plaintext value is recoverable. Third, the session token embedded in the URL path, which provides implicit CSRF protection, is fully visible to any party intercepting network traffic, rendering it ineffective as a security control. All of the above were confirmed by capturing traffic with Wireshark during a password change operation, which revealed the session token, credentials, and all request parameters in plaintext.

Remediation: Implement TLS and serve the management interface exclusively over HTTPS. Use secure session token handling that does not rely on URL-embedded tokens. Transmit sensitive form data via POST requests rather than GET parameters.

More information: See Web Interface Analysis chapter.