{"id":"CVE-2019-25252","state":"PUBLISHED","title":"Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change","description":"Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.","publishedAt":"2025-12-24T19:28:04.078Z","updatedAt":"2026-03-05T12:02:19.128Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Teradek VidiU Pro"],"affected":[{"vendor":"Teradek","product":"VidiU Pro","versions":[{"version":"3.0.3","status":"affected"},{"version":"3.0.2","status":"affected"},{"version":"2.4.10","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/44671","https://www.teradek.com","https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T19:45:53.332Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/25xxx/CVE-2019-25252.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-25252","state":"PUBLISHED","datePublished":"2025-12-24T19:28:04.078Z","dateUpdated":"2026-03-05T12:02:19.128Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-24T14:27:12.478Z"},"containers":{"cna":{"title":"Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change","descriptions":[{"lang":"en","value":"Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page."}],"affected":[{"vendor":"Teradek","product":"VidiU Pro","versions":[{"version":"3.0.3","status":"affected"},{"version":"3.0.2","status":"affected"},{"version":"2.4.10","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/44671","name":"ExploitDB-44671","tags":["exploit"]},{"url":"https://www.teradek.com","name":"Teradek Official Product Homepage","tags":["product"]},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php","name":"Zero Science Lab Disclosure (ZSL-2018-5460)","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","lang":"en","description":"Cross-Site Request Forgery (CSRF)","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T12:02:19.128Z"},"datePublic":"2018-03-02T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:teradek:vidiu_firmware:3.0.2:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"LiquidWorm as Gjoko Krstic of Zero Science Lab","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-24T20:01:39.699251Z","id":"CVE-2019-25252","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-24T20:22:04.713Z"}}]}}}