CVE-2019-25251

🗓️ 24 Dec 2025 19:28:03Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 10 Views🌐 WEB

Teradek VidiU Pro 3.0.3 SSRF via management interface enables manipulation of url and xml_url.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2019-25251	5 Jan 202616:34	–	circl
CNNVD	Teradek VidiU Pro 安全漏洞	24 Dec 202500:00	–	cnnvd
Cvelist	CVE-2019-25251 Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings	24 Dec 202519:28	–	cvelist
EUVD	EUVD-2025-205304	24 Dec 202521:30	–	euvd
NVD	CVE-2019-25251	24 Dec 202520:15	–	nvd
Positive Technologies	PT-2025-53337	24 Dec 202500:00	–	ptsecurity
Vulnrichment	CVE-2019-25251 Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings	24 Dec 202519:28	–	vulnrichment
Zero Science Lab	Teradek VidiU Pro 3.0.3 SSRF Vulnerability	21 May 201800:00	–	zeroscience

NVD

Vulners

Node

teradek vidiu_pro_firmwareMatch2.4.10

teradek vidiu_pro_firmwareMatch3.0.2build31225

teradek vidiu_pro_firmwareMatch3.0.3build32136

AND

teradek vidiu_proMatch-

Node

teradek vidiu_firmwareMatch2.4.10

teradek vidiu_firmwareMatch3.0.2build31225

teradek vidiu_firmwareMatch3.0.3build32136

AND

teradek vidiuMatch-

Node

teradek vidiu_mini_firmwareMatch2.4.10

teradek vidiu_mini_firmwareMatch3.0.2build31225

teradek vidiu_mini_firmwareMatch3.0.3build32136

AND

teradek vidiu_miniMatch-

[
  {
    "vendor": "Teradek, LLC",
    "product": "VidiU Pro",
    "versions": [
      {
        "version": "3.0.3r32136",
        "status": "affected"
      },
      {
        "version": "3.0.2r31225",
        "status": "affected"
      },
      {
        "version": "2.4.10",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/44672
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5461.php
teradek	www.teradek.com/

Parameter	Position	Path	Description	CWE
command	query param	cgi-bin/wowza.cgi	SSRF via GET parameter 'url' in the Wowza CGI interface to load external resources	CWE-918
url	query param	cgi-bin/wowza.cgi	SSRF via GET parameter 'url' in the Wowza CGI interface to load external resources	CWE-918
command	query param	cgi-bin/system.cgi	SSRF via GET parameter 'xml_url' (and related parameters) in the system CGI to fetch XML data from an arbitrary URL	CWE-918
action	query param	cgi-bin/system.cgi	SSRF via GET parameter 'xml_url' (and related parameters) in the system CGI to fetch XML data from an arbitrary URL	CWE-918
xml_url	query param	cgi-bin/system.cgi	SSRF via GET parameter 'xml_url' (and related parameters) in the system CGI to fetch XML data from an arbitrary URL	CWE-918

26 Jan 2026 16:15Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.5

CVSS 46.9

EPSS0.00017

SSVC

CWE-918