Description
Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'url' and 'xml_url'. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary destinations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Teradek | VidiU Pro | 3.0.3r32136, 3.0.2r31225, 2.4.10 | — |
References
- ExploitDB-44672 exploit
- Teradek Product Homepage product
- Zero Science Lab Disclosure (ZSL-2018-5461) third-party-advisory