External risk intelligence

Axel Technology Puma Firmware Broken Access Control Vulnerability Allows Full Device Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-63221

The vulnerability affects Axel Technology puma devices, which are typically network-attached broadcast or media appliances designed to be managed over a network. The exposed endpoint is a CGI script, a common pattern for device management web interfaces. Such devices are frequently configured with administrative interfaces accessible over the network, making them likely to be reachable if not properly isolated behind a firewall.

Axeltechnology Puma Firmware

0.8.5 to 1.0.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts Axel Technology puma devices, potentially allowing unauthenticated attackers to gain full control by listing users, creating new administrators, deleting accounts, and altering system settings. The primary concern is confirming whether these devices are in use and accessible, as the potential for a complete device compromise exists.

Unprotected controls allow system takeover.
Affects network-managed broadcast/media devices.
Confirm relevance and exposure of devices.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can access a specific web endpoint on Axel Technology puma devices to manage user accounts and system settings, potentially leading to a full device compromise. This is possible because the device's firmware does not require any authentication to access this sensitive management function.

Unauthenticated network access required.
Accessing the /cgi-bin/gstFcgi.fcgi endpoint.
Full device compromise.

Live Threat

Current exploitation, exposure, and threat context

The Axel Technology puma devices, when running specific firmware versions, have a security flaw that allows unauthenticated remote attackers to access a management endpoint. This could lead to unauthorized listing, creation, or deletion of user accounts, as well as modification of system settings, potentially resulting in complete control over the device.

User accounts and system settings.
Unauthenticated access to a network endpoint.
Full device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action will likely fall to teams managing network-attached devices and the broadcast infrastructure they support. The first practical move is to inventory all Axel Technology puma devices, confirm network exposure, identify the asset owner, and then assess business criticality before planning any remediation.

Identify affected Axel Technology puma devices.
Verify network exposure and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are Axel Technology puma devices?

These are specialized network-attached appliances used primarily in professional broadcast and media infrastructure environments. They rely on firmware to manage their functions and are designed to be configured and operated over a network connection.

What is the Broken Access Control vulnerability in CVE-2025-63221?

This weakness, categorized as CWE-284, means the device fails to properly restrict access to a critical management function. Because the /cgi-bin/gstFcgi.fcgi endpoint lacks authentication, it incorrectly treats unverified requests as legitimate, allowing unauthorized users to perform administrative tasks.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by sending network requests to the specific management endpoint mentioned in the firmware. It is important to note that internal, non-malicious traffic or standard user interactions with the intended web interface do not trigger this bug; it specifically requires targeting the unauthenticated management endpoint.

Who should be concerned about this CVE?

Anyone managing these devices should care, especially because Halo Surface Signal notes these appliances are often placed on networks for management purposes. If a device is not properly isolated behind a firewall or is reachable over the internet, it is at higher risk for unauthorized access.

How do I start managing this risk?

Your first step is to locate all Axel Technology puma units in your environment. Once identified, verify their network configuration to see if they are exposed to unauthorized access and determine their business importance to prioritize them for official firmware updates or network isolation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.