Administrative privilege escalation via interceptable Base64 credentials

Improper privilege management in Samsung SyncThru Web Service SPL 5.93 allows man-in-the-middle attackers to gain administrative privileges. The web login sends the administrator password as reversible Base64 data over an interceptable HTTP connection, allowing an on-path attacker to recover it. The attacker must share the printer's network path and capture an administrator login; the recovered credentials grant access to protected settings.