CVE-2019-25251

🗓️ 24 Dec 2025 19:28:03Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

Teradek VidiU Pro 3.0.3 SSRF via management interface enables manipulation of url and xml_url.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2019-25251	5 Jan 202616:34	–	circl
CNNVD	Teradek VidiU Pro 安全漏洞	24 Dec 202500:00	–	cnnvd
Cvelist	CVE-2019-25251 Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings	24 Dec 202519:28	–	cvelist
EUVD	EUVD-2025-205304	24 Dec 202521:30	–	euvd
NVD	CVE-2019-25251	24 Dec 202520:15	–	nvd
OSV	CVE-2019-25251	24 Dec 202520:15	–	osv
Positive Technologies	PT-2025-53337	24 Dec 202500:00	–	ptsecurity
Vulnrichment	CVE-2019-25251 Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings	24 Dec 202519:28	–	vulnrichment
Zero Science Lab	Teradek VidiU Pro 3.0.3 SSRF Vulnerability	21 May 201800:00	–	zeroscience

NVD

Vulners

CNA

Node

AND

teradek vidiu_pro_firmwareMatch2.4.10

teradek vidiu_pro_firmwareMatch3.0.2build31225

teradek vidiu_pro_firmwareMatch3.0.3build32136

teradek vidiu_proMatch-

Node

AND

teradek vidiu_firmwareMatch2.4.10

teradek vidiu_firmwareMatch3.0.2build31225

teradek vidiu_firmwareMatch3.0.3build32136

teradek vidiuMatch-

Node

AND

teradek vidiu_mini_firmwareMatch2.4.10

teradek vidiu_mini_firmwareMatch3.0.2build31225

teradek vidiu_mini_firmwareMatch3.0.3build32136

teradek vidiu_miniMatch-

[
  {
    "vendor": "Teradek, LLC",
    "product": "VidiU Pro",
    "versions": [
      {
        "version": "3.0.3r32136",
        "status": "affected"
      },
      {
        "version": "3.0.2r31225",
        "status": "affected"
      },
      {
        "version": "2.4.10",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/44672
teradek	www.teradek.com/
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5461.php

Parameter	Position	Path	Description	CWE
url	query param	cgi-bin/wowza.cgi?command=read_url&url=zeroscience.mk:443&_=	SSRF via GET parameter 'url' in wowza.cgi allowing request to external domain	CWE-918
xml_url	query param	cgi-bin/system.cgi?command=rtmp&action=rtmp_xml_from_url&xml_url=zeroscience.mk:7777&_=	SSRF/XXE potential via 'xml_url' in system.cgi to fetch remote XML data	CWE-918

15 Jul 2026 01:23Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.5

CVSS 46.9

EPSS0.00338

SSVC

CWE-918