CVE-2019-25252

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Teradek	VidiU Pro	3.0.3; 3.0.2; 2.4.10

References

https://www.exploit-db.com/exploits/44671Exploit
https://www.teradek.comProduct
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.phpExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.phpExploit, Third Party Advisory

Timeline

Published: Dec 24, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-252537.5KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauth CVE-2019-252548.8KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without CVE-2019-252554.3VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute s CVE-2019-252566.5VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbi CVE-2019-252576.5LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary p CVE-2019-252587.5LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary fil CVE-2019-252595.3Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform admi CVE-2019-25267.8Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are CVE-2019-252608.2OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert mal CVE-2019-252617.8AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentiall CVE-2019-252623.5A security vulnerability has been detected in elinicksic Razgover up to db37dfc5c82f023a40f2f7834ded6633fb2b5262. This affects an unknown pa CVE-2019-252636.4Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts thro