Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters url and xml_url. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary destinations.
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vidiu_pro_firmware | Teradek | 2.4.10 (including) | 2.4.10 (including) |
| Vidiu_pro_firmware | Teradek | 3.0.2-build31225 (including) | 3.0.2-build31225 (including) |
| Vidiu_pro_firmware | Teradek | 3.0.3-build32136 (including) | 3.0.3-build32136 (including) |