medium6.5
CVE-2019-25251
Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'ur…
Impact
Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'url' and 'xml_url'. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary destinations.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Teradek | Vidiu Pro Firmware | Versions 2.4.10, 3.0.2, 3.0.3 |
| Teradek | Vidiu Firmware | Versions 2.4.10, 3.0.2, 3.0.3 |
| Teradek | Vidiu Mini Firmware | Versions 2.4.10, 3.0.2, 3.0.3 |