CVE-2026-22543

The record

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials

Affected packages

Related vulnerabilities

• CVE-2026-63424 During an internal security assessment, an improperly protected key was discovered in… CWE-261
• CVE-2026-40639 Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. CWE-261
• CVE-2026-25607 Use of a weak password encoding algorithm in STER software allows the value of the… CWE-261
• CVE-2025-11500 Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two… CWE-261
• CVE-2026-0809 Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value… CWE-261
• CVE-2024-52334 A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). CWE-261
• CVE-2025-67652 An attacker with access to the project file could use the exposed credentials to… CWE-261