medium5.7
CVE-2025-63952
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts vi…
Impact
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Magewell | Pro Convert Hdmi 4k Plus Firmware | Version 1.2.213 |
| Magewell | Pro Convert Hdmi Plus Firmware | Version 1.2.213 |
| Magewell | Pro Convert Hdmi Tx Firmware | Version 1.2.213 |
| Magewell | Pro Convert 12g Sdi 4k Plus Firmware | Version 1.2.213 |
| Magewell | Pro Convert Sdi 4k Plus Firmware | Version 1.2.213 |
| Magewell | Pro Convert Sdi Plus Firmware | Version 1.2.213 |
| Magewell | Pro Convert Sdi Tx Firmware | Version 1.2.213 |
| Magewell | Pro Convert For Ndi To Hdmi Firmware | Version 1.2.213 |
| Magewell | Pro Convert For Ndi To Hdmi 4k Firmware | Version 1.2.213 |
| Magewell | Pro Convert For Ndi To Aio Firmware | Version 1.2.213 |
| Magewell | Pro Convert For Ndi To Sdi Firmware | Version 1.2.213 |
| Magewell | Pro Convert Aes67 Firmware | Version 1.2.213 |