CVE-2019-25240
Published: 24 December 2025
Summary
CVE-2019-25240 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Zeroscience (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2019-25240 is an unauthenticated vulnerability in the Rifatron 5brid DVR, specifically affecting the animate.cgi script within the Mobile Web Viewer module. This flaw allows attackers to access live video streams by specifying channel numbers to retrieve sequential video snapshots without any authentication, violating CWE-306 (Missing Authentication for Critical Function). The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its remote, low-complexity exploitation potential with high impacts on confidentiality, integrity, and availability.
Any network-accessible attacker can exploit this vulnerability without privileges or user interaction, simply by sending crafted requests to the animate.cgi endpoint with channel parameters. Successful exploitation grants unauthorized viewing of live video feeds from the DVR's channels, potentially exposing sensitive surveillance footage.
Advisories and proof-of-concept exploits are documented in references including the vendor site at http://www.rifatron.com, Exploit-DB at https://www.exploit-db.com/exploits/47368, and Zero Science Labs at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5532.php, which provide further details on the issue though specific mitigation or patch guidance is not detailed in the CVE record.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205308
Vulnerability details
Rifatron 5brid DVR contains an unauthenticated vulnerability in the animate.cgi script that allows unauthorized access to live video streams. Attackers can exploit the Mobile Web Viewer module by specifying channel numbers to retrieve sequential video snapshots without authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote access to live video streams via a public-facing web CGI script, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly identifies and restricts critical actions like retrieving video snapshots via animate.cgi that are permitted without identification or authentication, countering the missing authentication vulnerability.
Enforces approved authorizations requiring authentication for access to live video streams through the vulnerable Mobile Web Viewer script.
Implements deny-by-default public access protections for exposed web endpoints like animate.cgi, preventing unauthenticated remote exploitation of video streams.