External risk intelligence

Evertz SDVN 3080ipx-10G Authentication Bypass Leading to Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-10365

The device is a specialized high-bandwidth Ethernet switching fabric for video applications. While it exposes a web management interface on port 80, such infrastructure equipment is typically deployed within controlled, internal media production or broadcast networks. While technically reachable if misconfigured or intentionally exposed, public internet exposure is not a standard or intended deployment pattern.

Authentication Bypass

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects specialized video switching equipment, specifically the Evertz SDVN 3080ipx-10G, which has a web management interface that can be accessed by unauthenticated attackers. If exploited, this could allow them to gain full control of the device, potentially disrupting media streaming, altering content, or impacting closed caption generation. The primary concern is to confirm if these devices are deployed in your environment and if they are exposed externally.

Unauthenticated access to critical video infrastructure.
Potential for media stream interruption or alteration.
Confirm relevance and external exposure.

Attack Path

How an attacker could exploit the issue

Attackers can reach this device's web interface from the internet and bypass authentication. This allows them to execute arbitrary commands with root privileges, potentially disrupting media streaming or altering content.

No authentication required.
Triggered through the web management interface.
Full command execution with root privileges.

Live Threat

Current exploitation, exposure, and threat context

Remote, unauthenticated attackers could gain command execution with elevated privileges on affected devices. This could impact the integrity of media streams, including video content and closed captions, by allowing for modifications or interruptions when the device is accessible.

Media streaming services and content.
Through the web management interface.
Interruption or modification of media.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Evertz SDVN 3080ipx-10G, used for video application switching, has a critical vulnerability in its web management interface. This flaw allows unauthenticated remote attackers to gain root-level command execution. Given its role in media infrastructure, immediate assessment of asset criticality and network exposure is paramount, with potential impacts on media streaming and captioning services.

Infrastructure and platform teams likely own devices.
Verify network reachability and business criticality.
Coordinate vendor response and plan remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Evertz SDVN 3080ipx-10G?

The Evertz SDVN 3080ipx-10G is a specialized networking device designed as a high-bandwidth Ethernet switching fabric. It handles complex video application routing within professional broadcasting and media production environments. It relies on a PHP-based web management interface, developed with the webEASY SDK, to allow administrators to manage network configurations, license keys, and operational features over standard port 80.

What does CVE-2025-10365 mean?

CVE-2025-10365 represents an authentication bypass vulnerability, classified as CWE-287 (Improper Authentication). This weakness allows an attacker to gain access to the device's management interface without needing valid credentials. In the context of this device, bypassing this security check grants an attacker the ability to execute unauthorized commands as root, effectively giving them full control over the system.

How is this vulnerability triggered?

An attacker triggers this flaw by interacting directly with the device's web management interface on port 80. Because the system fails to verify identity, no prior knowledge of passwords or administrative accounts is required. It is important to note that the vulnerability exists within the management interface logic itself; simply having the device powered on and reachable is sufficient for an attacker to attempt exploitation.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies that this hardware is usually deployed in restricted, internal media production networks rather than directly on the public internet. However, if your network configuration has intentionally or accidentally exposed this management port to the internet, the risk increases significantly. You should verify your specific network perimeter to see if the interface is reachable from outside your controlled broadcast environment.

Do I need to take action if I manage this hardware?

Yes, you should prioritize verifying where these devices are deployed and if they are accessible from untrusted networks. Since this vulnerability grants root-level command execution, coordinate with your infrastructure team to audit access controls for the web interface immediately. Monitor vendor resources for official firmware updates or guidance on hardening the web management component to prevent unauthorized access.

References

www.onekey.com/resource/security-advisory-remote-code-execution-on-e…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.