External risk intelligence

Evertz SDVN Command Injection Allows Remote Root Access.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-10364

The vulnerability exists in a web-based management interface for specialized high-bandwidth Ethernet switching equipment. While such devices are often managed via internal, isolated management networks, the interface is network-reachable and could be exposed to the internet depending on specific customer deployment patterns and organizational security practices.

Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects high-bandwidth Ethernet switching devices used in video applications, specifically their web management interface. An unauthenticated attacker could execute arbitrary commands with root privileges, potentially leading to severe business impacts such as media stream interruption or modification.

Unauthenticated attackers can run commands on critical video network devices.
This could disrupt media streams or alter content.
Confirm relevance and exposure to sensitive media operations.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by accessing the device's web management interface over the network. By sending specially crafted requests to the `feature-transfer-export.php` endpoint, an attacker can inject and execute arbitrary commands with root privileges on the affected device. This could disrupt media streaming, alter content, or impact closed captions.

Network access required.
Command injection in export feature.
Full device control and service disruption.

Live Threat

Current exploitation, exposure, and threat context

Remote, unauthenticated attackers could execute arbitrary commands with root privileges on affected devices when interacting with specific web management interface endpoints. This could impact critical video streaming services, potentially leading to interruptions or alterations of media content, including closed captions.

System control and media services.
Via vulnerable web management interface endpoints.
Interruption or modification of video streams.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this critical vulnerability likely falls to infrastructure or platform teams responsible for network hardware, with potential collaboration from vendor management if a solution requires vendor involvement. The initial priority is to identify all instances of the Evertz SDVN 3080ipx-10G, determine their network exposure and business criticality, and confirm the accountable owner for each device. Subsequent remediation planning should be risk-based, considering factors like operational impact and potential vendor timelines.

Identify and confirm accountable owners.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Evertz SDVN 3080ipx-10G?

It is a high-bandwidth Ethernet switching fabric designed for professional video applications. The hardware utilizes the webEASY SDK to provide a web-based management interface on port 80, allowing administrators to configure network switching, register licenses, and manage specialized media product features.

How does CVE-2025-10364 work?

This vulnerability is classified as CWE-77, or Command Injection. It occurs because the web management interface fails to properly sanitize input before processing it. By sending a crafted request to the feature-transfer-export.php endpoint, an attacker can trick the system into executing unauthorized commands at the root privilege level.

Do I need to be logged in to trigger this bug?

No. The vulnerability can be triggered by an unauthenticated attacker, meaning no valid login credentials are required to interact with the vulnerable endpoint. Normal, legitimate use of the device's management interface features that do not involve this specific export function will not trigger the command injection.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies this as a potential risk because the device's management interface is network-reachable. While these switches are often intended for isolated, internal management networks, your specific risk depends on whether your deployment configuration has exposed this interface to the broader network or the internet.

When should I take action for this CVE?

Given the severity of potential impacts like media stream interruption or content alteration, you should prioritize identifying all instances of the Evertz SDVN 3080ipx-10G in your environment immediately. Confirm who owns these devices and assess their current network exposure to guide your initial risk-based response strategy.

References

www.onekey.com/resource/security-advisory-remote-code-execution-on-e…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.