External risk intelligence

Blackmagic ATEM Mini Pro Information Disclosure via Telnet

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-57441

The vulnerability involves an unauthenticated Telnet service on a specialized video production hardware device. While these devices are typically deployed within local production networks rather than directly exposed to the public internet, the service is network-accessible, making remote access plausible in certain misconfigured or specific network deployments.

Information Disclosure

Blackmagicdesign Atem Mini Pro Firmware

2.7

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Blackmagic ATEM Mini Pro devices that exposes sensitive configuration details over an unauthenticated network service. While these devices are typically used in production environments, the exposure of information like video modes and routing configurations could aid attackers in reconnaissance and planning further network intrusions. The main concern is confirming relevance and exposure within your specific environment.

Sensitive device information is exposed.
Aids in planning potential future attacks.
Confirm if these devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker can gain access to sensitive information about a video device by connecting to its Telnet service without any authentication. This service, accessible over the network, can reveal details like the current video setup, device model, and internal identifiers. Such information can help an attacker understand the device's configuration to plan further malicious activities.

Unauthenticated network access required.
Telnet service on port 9990.
Reconnaissance for further attacks.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could expose sensitive details about the Blackmagic ATEM Mini Pro's configuration and internal identifiers when its Telnet service is accessible over the network. Attackers could use this information for reconnaissance to plan further malicious activities.

Device configuration and internal identifiers at risk.
Exposure via unauthenticated Telnet service.
Enables reconnaissance for further attacks.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, the platform team or infrastructure team responsible for the ATEM Mini Pro devices would likely lead remediation. The first practical step is to identify all deployed ATEM Mini Pro devices, determine their network exposure, and confirm their business criticality. Subsequently, the accountable owner should be identified to plan remediation, which may involve network segmentation, configuration changes, or vendor coordination.

Platform or infrastructure teams own resolution.
Verify network exposure and business criticality.
Plan for configuration changes or vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Blackmagic ATEM Mini Pro?

The Blackmagic ATEM Mini Pro is a compact, professional-grade live production switcher. It is widely used by broadcasters, content creators, and corporate AV teams to mix multiple video sources, manage audio levels, and stream live events to internet platforms. It acts as the central hub for video signal routing and orchestration in live production workflows.

What does CVE-2025-57441 mean for this device?

This vulnerability involves an information disclosure flaw, classified as CWE-200. It occurs because the device runs an unauthenticated Telnet service on port 9990. Anyone who can reach this port can read internal configuration data, such as routing setups and device identifiers, which provides technical intelligence an attacker could use to prepare for a more targeted strike.

How is this vulnerability triggered?

An attacker triggers this by initiating a standard Telnet connection to port 9990 on the device. Once connected, the device immediately returns a protocol preamble containing configuration details. Simply being on the same local network or having a path to the device's IP address is sufficient; no valid user credentials or authentication steps are required to extract this sensitive data.

Is my Blackmagic ATEM Mini Pro at risk?

According to Halo Surface Signal, risk depends on network placement. While these switchers are typically kept on isolated production networks, they are often reachable if misconfigured or if the network is broad. You should be concerned if your device is accessible from outside your local production environment or if unauthorized personnel have network access to the port.

How do I respond to this advisory?

Begin by auditing your infrastructure to locate all deployed ATEM Mini Pro units. Check your network configuration to see if port 9990 is reachable from untrusted segments. Work with your network team to restrict access to these ports, ensuring the devices are not inadvertently exposed. Finally, contact your vendor or support representative to inquire about upcoming firmware updates or authorized configuration hardening steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.