CVE-2019-25252
5.1
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)
Description
Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.
Affected (9)
Products: Teradek: Vidiu Pro Firmware, Vidiu Firmware, Vidiu Mini Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2.4.10 |
| Running on/with | Platform Versions |
|---|---|
Teradek Vidiu Pro | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2.4.10 |
| Running on/with | Platform Versions |
|---|---|
Teradek Vidiu | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2.4.10 |
| Running on/with | Platform Versions |
|---|---|
Teradek Vidiu Mini | All versions |
References (4)
Source: disclosure@vulncheck.com
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory
Timeline
No history available yet.