CVE-2025-57432
Published: 22 September 2025
Summary
CVE-2025-57432 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Blackmagicdesign Web Presenter Hd Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and CM-7 (Least Functionality).
Deeper analysis
CVE-2025-57432 affects Blackmagic Web Presenter version 3.3, which exposes a Telnet service on port 9977 that accepts unauthenticated commands. This vulnerability, classified under CWE-306 (Missing Authentication for Critical Function), enables remote attackers to manipulate stream settings, change video modes, and potentially alter other device functionality without any credentials or authentication mechanisms. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and high impacts on confidentiality, integrity, and availability.
Any remote attacker with network access to the affected device can exploit this vulnerability without privileges or user interaction. By connecting to the Telnet service on port 9977, attackers can issue commands to reconfigure streaming parameters, switch video modes, or disrupt device operations, potentially leading to denial of service, unauthorized control over video outputs, or exposure of sensitive configuration data.
References for this CVE include a GitHub repository at https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57432 containing vulnerability research and the vendor site at https://www.blackmagicdesign.com/. No specific patch or mitigation details are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-30818
Vulnerability details
Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manipulate stream settings, including changing video modes and possibly altering device functionality. No credentials or authentication mechanisms are…
more
required to interact with the Telnet interface.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an unauthenticated Telnet service exposed on port 9977, enabling remote exploitation of a public-facing application/service for initial access and command execution to manipulate device settings.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 directly restricts permitted actions without identification or authentication, mitigating the unauthenticated Telnet commands that allow remote manipulation of stream settings and device functions.
CM-7 enforces least functionality by prohibiting unnecessary services like the exposed Telnet port 9977, preventing remote attackers from issuing unauthenticated commands.
SC-7 provides boundary protection to monitor and control communications to the Telnet service on port 9977, blocking unauthorized remote access.