Media Server CVE-2025-49194

The CVSS 7.5 score reflects a high-severity confidentiality impact with low attack complexity and no privilege requirements, accurately characterizing the threat. The attack vector (AV:N) indicates network accessibility from any network position, making this readily exploitable through passive network sniffing, ARP spoofing, DNS hijacking, or BGP hijacking depending on network topology. The AC:L (Low Complexity) rating confirms no specialized skills are required beyond basic packet capture tools (tcpdump, Wireshark). The critical risk indicator is the presence of multiple attack paths: (1) passive interception on shared networks (coffee shops, hotels), (2) active MITM attacks on compromised networks, (3) compromised network infrastructure. Without additional intelligence on EPSS score, KEV catalog status, or public POC availability, the real-world priority should be assessed as CRITICAL if this affects internet-facing authentication services, as credential compromise directly enables account takeover. This is not a false-positive high-CVSS issue—cleartext credential transmission is fundamentally exploitable and has consistently appeared in breach databases. Organizations must treat this as a priority remediation target.

An attacker on a shared network (corporate WiFi, public WiFi, or ISP backbone) runs a passive packet sniffer (tcpdump, Wireshark) configured to extract HTTP traffic. A user attempts to authenticate to a web application or service over HTTP, sending their username and password in the Authorization header (Basic Auth) or form POST data. The attacker's sniffer immediately captures the unencrypted credentials in plaintext. The attacker decodes the Base64-encoded Basic Auth header (trivial) or extracts POST parameters, obtaining valid credentials. The attacker can then authenticate as the legitimate user, accessing protected resources and exfiltrating data without detection. In active attack variants, the attacker performs ARP spoofing or DNS hijacking to intercept traffic from multiple users, harvesting credentials at scale. This scenario requires zero exploit code complexity—standard network tools suffice—making it immediately executable by low-skill attackers and highly attractive for automated credential harvesting campaigns targeting organizations still using plaintext authentication.