CVE-2025-63953

A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-63953	Exploit Third Party Advisory Mitigation
https://www.magewell.com	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:magewell:ultra_encode_hdmi_firmware:2.3.206:*:*:*:*:*:*:*

cpe:2.3:h:magewell:ultra_encode_hdmi:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:magewell:ultra_encode_sdi_firmware:2.3.206:*:*:*:*:*:*:*

cpe:2.3:h:magewell:ultra_encode_sdi:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:magewell:ultra_encode_hdmi_plus_firmware:2.3.206:*:*:*:*:*:*:*

cpe:2.3:h:magewell:ultra_encode_hdmi_plus:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:magewell:ultra_encode_sdi_plus_firmware:2.3.206:*:*:*:*:*:*:*

cpe:2.3:h:magewell:ultra_encode_sdi_plus:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:magewell:ultra_encode_aio_firmware:2.3.206:*:*:*:*:*:*:*

cpe:2.3:h:magewell:ultra_encode_aio:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-11-24 17:16

Updated : 2025-12-30 17:58

NVD link : CVE-2025-63953

Mitre link : CVE-2025-63953

CVE.ORG link : CVE-2025-63953

JSON object : View

Products Affected

magewell

ultra_encode_aio
ultra_encode_sdi_plus
ultra_encode_sdi_firmware
ultra_encode_sdi_plus_firmware
ultra_encode_sdi
ultra_encode_hdmi_firmware
ultra_encode_aio_firmware
ultra_encode_hdmi
ultra_encode_hdmi_plus
ultra_encode_hdmi_plus_firmware

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-63953", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-11-24T17:16:08.760", "references": [{"url": "https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-63953", "tags": ["Exploit", "Third Party Advisory", "Mitigation"], "source": "cve@mitre.org"}, {"url": "https://www.magewell.com", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request."}], "lastModified": "2025-12-30T17:58:54.510", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:magewell:ultra_encode_hdmi_firmware:2.3.206:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EBB246F-AE8D-480A-AE2C-E7D093A30195"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:magewell:ultra_encode_hdmi:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4CC31127-AB61-4754-880C-99E5B7C3452C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:magewell:ultra_encode_sdi_firmware:2.3.206:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05F10943-501A-43A6-A45D-6DC7D490706C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:magewell:ultra_encode_sdi:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2C99D9AB-1101-4146-A36A-91639736DE79"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:magewell:ultra_encode_hdmi_plus_firmware:2.3.206:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4EB611F-B561-4904-9E24-FF69D4063156"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:magewell:ultra_encode_hdmi_plus:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8EB5460-3EC5-4A68-8EBE-AA7181778587"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:magewell:ultra_encode_sdi_plus_firmware:2.3.206:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E765AED8-6C62-4380-BA4C-1399668373F9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:magewell:ultra_encode_sdi_plus:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "921BD6B9-7983-47A0-9345-7157ED9C6FA6"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:magewell:ultra_encode_aio_firmware:2.3.206:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0D501AB-2A8E-4554-8F44-BC1EFCFD7A2A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:magewell:ultra_encode_aio:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CB453C74-42EA-4096-A03A-44391D71D333"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}