CRITICAL🇵🇱 Wersja polska

CVE-2025-57437

CVSS 9.8v3.1pub. 2025-09-22upd. 2025-10-10

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extensive device configuration data including: - Model, version, and unique identifiers - Network settings including IP, MAC, DNS - Current stream platform, stream key, and streaming URL - Audio/video configuration This data can be used to hijack live streams or perform network reconnaissance.

🤖 AI Analysis
How it works

The Telnet service running on port 9977 requires no authentication, allowing any network-accessible attacker to establish a connection and read data. Upon connection, the service automatically discloses extensive device configuration information, including model, identifiers, network settings (IP, MAC, DNS), current streaming platform, stream key, stream URL, and audio/video configuration. The attack vector is network-based, requires no user interaction or any privileges, making the vulnerability trivial to exploit.

Impact

An attacker can hijack an active video stream (stream hijacking) by obtaining the stream key and conduct network reconnaissance based on disclosed network settings and device identifiers.

Mitigation & patch

Apply patches available from the manufacturer according to the references. Until the firmware is updated, it is recommended to block access to TCP port 9977 at the firewall level and isolate the device in a dedicated network segment with restricted access.

Who is affected

Blackmagic Web Presenter HD and Blackmagic Web Presenter HD Firmware version 3.3

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Blackmagicdesign Web Presenter Hd

    HW
    Blackmagicdesign
    wszystkie wersje

  • Blackmagicdesign Web Presenter Hd Firmware

    OS
    Blackmagicdesign
    3.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-57432CRITICAL9.8PL ✓ten sam produkt

Blackmagic Web Presenter — nieuwierzytelniony dostęp do usługi Telnet

CVE-2025-57441CRITICAL9.8PL ✓ten sam vendor

Blackmagic ATEM Mini Pro – ujawnienie konfiguracji przez nieuwierzytelniony Telnet

CVE-2021-40417CRITICAL9.8ten sam vendor

When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination ...

CVE-2021-40418CRITICAL9.8ten sam vendor

When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over...