Vidiu Pro CVEs and Security Vulnerabilities

CVE-2019-25251

Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings

Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'url' and 'xml_url'. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary destinations.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Teradek

Products

Vidiu Vidiu Firmware Vidiu Mini and 3 more

CVE-2019-25252

Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change

Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed