What is the CVSS score of CVE-2025-49194?

CVE-2025-49194 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Media Server are affected by CVE-2025-49194?

CVE-2025-49194 allows attackers to intercept and steal user credentials transmitted in plaintext over unencrypted channels.

How to fix or mitigate CVE-2025-49194?

Within 24 hours: Identify all systems running affected server versions and assess whether plaintext authentication methods are actively used in production. Within 7 days: Implement network segmentation to restrict server access to trusted internal networks only, and disable plaintext authentication methods where functionally possible. Within 30 days: Enforce mandatory TLS/encrypted channels for all authentication traffic, require multi-factor authentication, and conduct credential audit for potential compromise during interim period.

Media Server CVE-2025-49194

EUVD-2025-18193 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2025-06-12 psirt@sick.de

Information Disclosure Authentication Bypass Media Server

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:20 euvd

EUVD-2025-18193

Analysis Generated

Mar 14, 2026 - 21:20 vuln.today

CVE Published

Jun 12, 2025 - 15:15 nvd

HIGH 7.5

DescriptionCVE.org

The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.

AnalysisAI

Cleartext credential transmission vulnerability where a server accepts authentication methods that transmit credentials over unencrypted channels, allowing network-based attackers to intercept and expose user credentials without requiring authentication or user interaction. The vulnerability affects any server implementation supporting plaintext credential transmission over HTTP or other unencrypted protocols. This is a high-severity confidentiality issue (CVSS 7.5) with network-accessible attack vector and no complexity requirements, making it exploitable by unauthenticated remote attackers through passive network interception.

Technical ContextAI

This vulnerability stems from CWE-319 (Cleartext Transmission of Sensitive Information), a fundamental security weakness where authentication credentials are transmitted without encryption. The root cause typically involves servers accepting HTTP Basic Authentication, plaintext login forms, or custom authentication protocols over unencrypted HTTP rather than enforcing HTTPS/TLS. The vulnerability exists at the protocol/configuration layer rather than in specific cryptographic implementations. Affected systems likely include legacy web servers, application servers, APIs, or custom services that support deprecated authentication methods (HTTP Basic Auth, form-based login over HTTP) without mandatory TLS encryption. This represents a violation of secure communication practices and indicates either misconfiguration or deliberate support for legacy clients without modern encryption requirements.

RemediationAI

Immediate mitigations: (1) Enforce HTTPS/TLS for all authentication endpoints (minimum TLS 1.2, preferably TLS 1.3), (2) Disable HTTP access entirely or implement automatic HTTP-to-HTTPS redirects with HSTS headers, (3) Audit server configurations for disabled plaintext authentication methods, (4) Migrate from HTTP Basic Authentication to token-based methods (OAuth 2.0, JWT) over HTTPS, (5) Implement network segmentation to limit credential exposure risk. Patch deployment: Consult vendor security advisories for specific patched versions that remove plaintext authentication support or mandate TLS. For open-source projects (Apache, nginx), upgrade to versions with security updates that enforce encryption requirements. For custom applications, code review to eliminate any credential transmission outside of TLS-protected channels. Verification: Perform network packet inspection to confirm credentials are not transmitted in cleartext; test with tools like Burp Suite or OWASP ZAP to confirm HTTP credential submission is blocked.