CVE-2025-63223: Streamermax Mk Ii Firmware: güvenlik açığı

Açıklama (NVD)

The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.

Özet bilgiler

Ürün

Axeltechnology Streamermax Mk Ii Firmware

CVSS v3.1

9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

%0,80 (yüzdelik 57)

CWE

CWE-284

Yama

Geçici çözüm

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• www.axeltechnology.com
• github.com
• CWE-284