Media Server EUVD-2025-18186

CVSS 7.5 (High) reflects network-accessible unencrypted communication with no authentication barriers and high confidentiality impact, but zero integrity/availability impact since the attacker cannot modify or disrupt service. The attack vector is network-based with low complexity and no privileges required—any device on the network path can intercept traffic. However, real-world risk escalation depends on: (1) KEV/active exploitation status unknown from provided data—if no active KEV designation, this may indicate limited weaponization despite theoretical severity; (2) EPSS score not provided, but cleartext transmission vulnerabilities in APIs typically score 0.80+ EPSS when networks are untrusted (public WiFi, cloud infrastructure, ISPs); (3) POC availability not specified, but HTTP interception is trivial (Wireshark, tcpdump, transparent proxies); (4) SSVC perspective: exploitation is unavoidable if attacker reaches the network segment, technical impact is total confidentiality loss of API data, but automatability is low (requires targeted network positioning). Risk is HIGH in untrusted network environments (public internet, shared cloud) and MODERATE in isolated corporate networks with egress filtering; organizations using this API for sensitive operations (financial, healthcare, authentication) face critical risk even at CVSS 7.5.

An attacker on the same network as an API client (e.g., shared corporate WiFi, compromised ISP, AWS/Azure VPC with overpermissioned security groups) uses passive network sniffing (Wireshark, tcpdump) or ARP spoofing to intercept HTTP traffic to the REST API. The attacker captures unencrypted API requests containing: (1) authentication tokens or API keys in Authorization headers; (2) user PII in request/response JSON payloads; (3) media file URLs or file contents in responses. The attacker then replays captured credentials to impersonate users, downloads sensitive media files (documents, images, videos), or performs reconnaissance to identify API endpoints and data structures for further attacks. No POC is required—HTTP interception is well-established and automated tools exist. Example: attacker on corporate WiFi intercepts requests to /api/v1/user/profile, /api/v1/media/download, capturing session tokens and exfiltrating customer data. Attack complexity is low because HTTP is stateless and does not require user interaction to exploit.