External risk intelligence

Blackmagic Web Presenter Unauthenticated Telnet Command Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-57432

The vulnerability affects a Telnet service on a media streaming device. While Telnet is a network-accessible protocol, these devices are typically deployed within local production networks or specialized broadcast environments rather than being exposed directly to the public internet. Internet reachability is possible depending on network configuration but is not the standard or intended deployment pattern for this hardware.

Missing Authentication

Blackmagicdesign Web Presenter Hd Firmware

3.3

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Blackmagic Web Presenter devices, specifically affecting a Telnet service that allows unauthenticated remote command execution. This could enable unauthorized users to alter stream settings and potentially disrupt device operations. The main concern is confirming relevance and exposure within your specific network environment.

Unsecured service allows remote control.
Potential for unauthorized stream manipulation.
Confirm if this technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach a streaming device's exposed Telnet service from the internet without any authentication. Once connected, the attacker can send commands to alter stream settings, such as changing video modes, which could lead to a significant disruption of the device's functionality.

Accessible service on the network.
Unauthenticated commands can be sent.
Complete control over stream settings.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the stream settings and overall functionality of a Blackmagic Web Presenter device when its Telnet service is accessible over a network. Unauthenticated commands can be sent to alter video modes and potentially change how the device operates.

Device stream settings.
Unauthenticated network commands.
Altered device functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Blackmagic Web Presenter devices running specific firmware. Responsibility likely falls to teams managing broadcast equipment or AV infrastructure, with initial steps focusing on identifying affected devices, assessing their network exposure and criticality, and confirming the accountable owner for remediation planning.

Identify asset owners and confirm exposure.
Verify device reachability and business impact.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Blackmagic Web Presenter?

The Blackmagic Web Presenter is a hardware device designed for professional live streaming. It converts professional SDI video sources into a streamable format for platforms like YouTube or Twitch. It is widely used by broadcasters and content creators to bridge the gap between high-end video production equipment and internet-based streaming services.

How does CVE-2025-57432 impact security?

This vulnerability is classified as a Missing Authentication for Critical Function (CWE-306). It means the device's Telnet interface lacks any password protection or identity verification. Because of this weakness, any user who can reach the device over the network can send commands to change video settings or interfere with the unit's core operations.

What triggers this vulnerability?

The issue is triggered when an attacker initiates a Telnet connection to port 9977 on an affected device. The vulnerability does not require the attacker to have previous access to the system or knowledge of existing credentials. Simply reaching the open port allows for immediate, unauthenticated command execution.

Is my device vulnerable if it is not on the internet?

Halo Surface Signal notes that while these devices are often used in private production networks, they are still at risk if they are reachable from any network where an unauthorized person exists. If your device is accessible via a wide-area network or a poorly segmented local network, it may be reachable by actors who should not have administrative control.

How should I respond to this advisory?

Your first step is to locate all Blackmagic Web Presenter units in your environment and identify who manages them. Once identified, verify if they are connected to any network segments that allow unauthorized access. Coordinate with your infrastructure or AV team to restrict access to port 9977 and prepare for firmware updates when available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.