Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.
PUBLISHED5.2CWE-352
Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change
Problem type
Affected products
Teradek
VidiU Pro
3.0.3 - AFFECTED
3.0.2 - AFFECTED
2.4.10 - AFFECTED
References
ExploitDB-44671
https://www.exploit-db.com/exploits/44671
Teradek Official Product Homepage
https://www.teradek.com
Zero Science Lab Disclosure (ZSL-2018-5460)
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php
GitHub Security Advisories
GHSA-wwpx-mj82-gp77
Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers...
https://github.com/advisories/GHSA-wwpx-mj82-gp77Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2019-25252Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2019-25252",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"dateUpdated": "2025-12-24T20:22:04.713Z",
"dateReserved": "2025-12-24T14:27:12.478Z",
"datePublished": "2025-12-24T19:28:04.078Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2025-12-24T19:28:04.078Z"
},
"datePublic": "2018-03-02T00:00:00.000Z",
"title": "Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change",
"descriptions": [
{
"lang": "en",
"value": "Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page."
}
],
"affected": [
{
"vendor": "Teradek",
"product": "VidiU Pro",
"versions": [
{
"version": "3.0.3",
"status": "affected"
},
{
"version": "3.0.2",
"status": "affected"
},
{
"version": "2.4.10",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Cross-Site Request Forgery (CSRF)",
"cweId": "CWE-352",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.exploit-db.com/exploits/44671",
"name": "ExploitDB-44671",
"tags": [
"exploit"
]
},
{
"url": "https://www.teradek.com",
"name": "Teradek Official Product Homepage",
"tags": [
"product"
]
},
{
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php",
"name": "Zero Science Lab Disclosure (ZSL-2018-5460)",
"tags": [
"third-party-advisory"
]
}
],
"metrics": [
{
"format": "CVSS"
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"value": "LiquidWorm as Gjoko Krstic of Zero Science Lab",
"type": "finder"
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-12-24T20:22:04.713Z"
},
"title": "CISA ADP Vulnrichment",
"references": [
{
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php",
"tags": [
"exploit"
]
}
],
"metrics": [
{}
]
}
]
}
}