Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2025-7202

Cross-Site Request Forgery (CSRF) allowed remote control of Elgato Key Lights

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Toreon

Description

A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles the victim's lights.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elgato Key Light

Default version status: unaffected

  • 0 to ≤ 1.0.3(218)affected

Elgato Key Light Air

Default version status: unaffected

  • 0 to ≤ 1.0.3.220affected

Elgato Key Light Mini

Default version status: unaffected

  • 0 to ≤ 1.0.4.239affected

Elgato Key Light Neo

Default version status: unaffected

  • 0 to ≤ 1.0.4.206affected

Elgato Ring Light

Default version status: unaffected

  • 0 to ≤ 1.0.4.149affected

Elgato Light Strip

Default version status: unaffected

  • 0 to ≤ 1.0.4.231affected

Elgato Light Strip Pro

Default version status: unaffected

  • 0 to ≤ 1.0.1.145affected

References