External risk intelligence

Blackmagic Web Presenter HD Firmware Information Disclosure Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-57437

The vulnerability involves an unauthenticated Telnet service on a media streaming device. While such devices are often deployed on local networks to manage stream configurations, they may be exposed to the internet in some environments to allow remote administration or streaming, making internet reachability possible though not necessarily the standard deployment pattern.

Information Disclosure

Blackmagicdesign Web Presenter Hd Firmware

3.3

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the firmware of Blackmagic Web Presenter HD devices, specifically exposing sensitive configuration data through an unauthenticated Telnet service. This information, if accessed by unauthorized parties, could be leveraged to disrupt live streaming operations or conduct further network reconnaissance.

Sensitive device data is exposed online.
Stream hijacking and reconnaissance are possible.
Confirm relevance to protect streaming operations.

Attack Path

How an attacker could exploit the issue

An attacker could access sensitive configuration details by connecting to the device's unauthenticated Telnet service, enabling them to potentially hijack live streams or gather further network intelligence. This vulnerability requires no prior authentication, making it accessible to anyone who can reach the device over the network.

Unauthenticated network access required.
Telnet service reveals sensitive data.
Risk of stream hijacking and reconnaissance.

Live Threat

Current exploitation, exposure, and threat context

The Blackmagic Web Presenter HD firmware, when running version 3.3, exposes sensitive device configuration details through an unauthenticated Telnet service. This data, including network settings and stream keys, could potentially be accessed by unauthorized individuals.

Device configuration data at risk.
Via unauthenticated Telnet service.
Could enable stream hijacking or reconnaissance.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability likely impacts Media Operations or Production teams responsible for the Blackmagic Web Presenter HD devices, as well as potentially IT Infrastructure or Network teams if the devices are managed centrally. The first practical step is to locate all deployed Web Presenter HD devices, assess their network exposure and criticality, and identify the accountable owner for each. This will inform a prioritized remediation plan, which may involve coordinating with the vendor for firmware updates or implementing temporary network segmentation.

Media Operations and IT Infrastructure teams.
Verify device network reachability and criticality.
Plan coordinated firmware updates or network controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Blackmagic Web Presenter HD?

It is a hardware device used to stream video from professional cameras to the internet. It acts as a bridge, converting SDI video inputs into a format suitable for streaming platforms like YouTube or Twitch. The firmware manages essential tasks like network connectivity, stream encoding, and platform authentication.

What does CWE-200 mean for CVE-2025-57437?

CWE-200 is the weakness class for information exposure. In this case, the device accidentally broadcasts sensitive configuration details through a service meant for management. This flaw allows unauthorized users to read private data—such as stream keys and network settings—simply by connecting to the device, without needing a password.

How can an attacker trigger this vulnerability?

An attacker triggers this by initiating a Telnet connection to port 9977 on the affected device. Because the service lacks authentication, it immediately provides device information upon connection. Merely having the device powered on or using its standard streaming functions does not trigger the vulnerability; it requires a specific network request to that port.

Is my device vulnerable if it is not on the public internet?

Halo Surface Signal indicates that while these devices are typically on local networks, they are sometimes exposed to the internet for remote management. If your device is reachable from the public internet, it faces a higher risk. However, any user on your internal network could also access the Telnet service if your network controls do not restrict traffic to that port.

What should I do to secure my device?

Start by identifying all deployed Web Presenter HD units in your environment and checking their current firmware version. Since this issue involves an open network service, restrict access to the device at the network level to prevent unauthorized connections. Finally, coordinate with your IT or infrastructure team to track official vendor guidance on firmware updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.