Cleartext Transmission of Administrator Credentials via HTTP Basic Authentication on Waveshare RS232/485 TO WIFI ETH (B)

Cleartext Transmission of Credentials / Unprotected Transport:

Credentials are transmitted via HTTP Basic Authentication in plaintext over unencrypted HTTP.

The embedded web interface of the Waveshare Industrial-grade Serial Server-to-Wi-Fi gateway devices uses HTTP Basic Authentication over plaintext HTTP. Administrator credentials are transmitted as Base64-encoded strings within the Authorization header. Base64 is an encoding method, not encryption, and can be trivially decoded by an attacker monitoring network traffic.

The device does not offer HTTPS/TLS support, exposing user credentials to passive interception by any attacker on the same network. This leads to direct compromise of authentication, confidentiality, and enables unauthorized access to sensitive OT configuration interfaces.

This behavior violates secure transport principles and exposes administrative operations in ICS environments to interception, credential theft, and unauthorized system reconfiguration.