---
id: CVE-2025-25613
title: >-
  FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2
  x 1Gb SFP, Fanless
summary: >-
  FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2
  x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to
  transmit cookies for their web based administrative application containing
  user…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-312
vendor: fs
product: s3150-8t2f_firmware
affected:
  - s3150-8t2f_firmware < 2.2.0D
patched:
  - s3150-8t2f_firmware 2.2.0D
published: '2025-11-20'
updated: '2026-07-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-25613'
references:
  - url: 'https://github.com/SwiftSecur/S3150-8T2F-FS.com-Research/wiki'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00234
epssPercentile: 0.12699
ingestedAt: '2026-07-06T16:44:34.316Z'
---

## Overview

FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext using simple base64 encoding during every POST request made to the server.

## Affected

- `s3150-8t2f_firmware < 2.2.0D`

## Remediation

Upgrade past the affected range:

- `s3150-8t2f_firmware 2.2.0D`