CVE-2019-25252

🗓️ 24 Dec 2025 19:28:04Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 4 Views🌐 WEB

Teradek VidiU Pro 3.0.3 CSRF allows changing admin passwords without validation via malicious pages.

Reporter	Title	Published	Views	Family All 8
CNNVD	Teradek VidiU Pro 安全漏洞	24 Dec 202500:00	–	cnnvd
Cvelist	CVE-2019-25252 Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change	24 Dec 202519:28	–	cvelist
EUVD	EUVD-2025-205295	24 Dec 202521:30	–	euvd
NVD	CVE-2019-25252	24 Dec 202520:15	–	nvd
OSV	CVE-2019-25252	24 Dec 202520:15	–	osv
Positive Technologies	PT-2025-53338	24 Dec 202500:00	–	ptsecurity
Vulnrichment	CVE-2019-25252 Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change	24 Dec 202519:28	–	vulnrichment
Zero Science Lab	Teradek VidiU Pro 3.0.3 CSRF Change Password Exploit	21 May 201800:00	–	zeroscience

NVD

Vulners

CNA

Node

teradek vidiu_pro_firmwareMatch2.4.10

teradek vidiu_pro_firmwareMatch3.0.2build31225

teradek vidiu_pro_firmwareMatch3.0.3build32136

AND

teradek vidiu_proMatch-

Node

teradek vidiu_firmwareMatch2.4.10

teradek vidiu_firmwareMatch3.0.2build31225

teradek vidiu_firmwareMatch3.0.3build32136

AND

teradek vidiuMatch-

Node

teradek vidiu_mini_firmwareMatch2.4.10

teradek vidiu_mini_firmwareMatch3.0.2build31225

teradek vidiu_mini_firmwareMatch3.0.3build32136

AND

teradek vidiu_miniMatch-

[
  {
    "vendor": "Teradek",
    "product": "VidiU Pro",
    "versions": [
      {
        "version": "3.0.3",
        "status": "affected"
      },
      {
        "version": "3.0.2",
        "status": "affected"
      },
      {
        "version": "2.4.10",
        "status": "affected"
      }
    ]
  }
]

Source	Link
teradek	www.teradek.com/
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php
exploit-db	www.exploit-db.com/exploits/44671

Parameter	Position	Path	Description	CWE
pw1	request body	127.0.0.1:8090/cgi-bin/password.cgi	CSRF vulnerability via password.cgi allowing password change without proper request validation	CWE-352
pw2	request body	127.0.0.1:8090/cgi-bin/password.cgi	CSRF vulnerability via password.cgi allowing password change without proper request validation	CWE-352
user	request body	127.0.0.1:8090/cgi-bin/password.cgi	CSRF vulnerability via password.cgi allowing password change without proper request validation	CWE-352

05 Mar 2026 12:02Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.14.3

CVSS 45.1

EPSS0.00007

SSVC

CWE-352