External risk intelligence

Axel StreamerMAX MK II Broken Access Control Allows Full Device Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63223

The affected product is a dedicated streaming device (StreamerMAX MK II) designed for remote management and broadcasting. These appliances are frequently deployed at network edges, intended for remote access to system settings and streaming configurations, making them likely to be exposed to the internet in common deployment scenarios.

Axeltechnology Streamermax Mk Ii Firmware

0.8.5 to 1.0.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts Axel Technology StreamerMAX MK II devices, allowing unauthenticated attackers to gain full control by listing users, creating new administrators, deleting users, and altering system settings. The concern is confirming whether our environment utilizes these specific devices and, if so, understanding their exposure.

Unauthorized users can gain full device control.
Critical for leadership to confirm relevance and exposure.
Focus on confirming exposure and understanding risk.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by remotely accessing the streamer device over the network without needing any credentials. By targeting a specific endpoint, an unauthenticated user can gain unauthorized control, allowing them to view, create, or delete user accounts, and alter system configurations, ultimately leading to a complete takeover of the device.

Unauthenticated remote network access required.
Exploits missing authentication on an API endpoint.
Leads to full device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to gain complete control of Axel Technology StreamerMAX MK II devices. Attackers could potentially modify system settings, add or remove administrative users, and list existing user accounts, compromising the device's intended functionality and security.

Affected asset: Device configuration and user accounts.
Exposure: Network access to the management interface.
Consequence: Full device compromise and unauthorized control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Axel Technology StreamerMAX MK II devices, potentially managed by infrastructure or platform teams responsible for these appliances. The initial focus should be on identifying all deployed devices, assessing their network exposure and business criticality, and pinpointing the accountable owner for remediation planning.

Identify device owners and inventory.
Verify network reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Axel Technology StreamerMAX MK II?

StreamerMAX MK II devices are specialized hardware appliances designed for professional audio and video broadcasting. They act as central hubs for managing streaming workflows and system configurations, often serving as a critical point of control for media infrastructure. Because these devices are built for remote management, they provide administrative interfaces that allow users to oversee broadcast operations and user accounts.

What does Broken Access Control mean for CVE-2025-63223?

This vulnerability is classified as CWE-284, which refers to improper access control. In the context of this CVE, it means the software fails to verify who is allowed to access certain management functions. Because the specific endpoint handling these requests does not require a login, the device cannot distinguish between an authorized administrator and an outside user, essentially leaving the keys to the system wide open.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by sending requests to a specific internal file on the device, known as an endpoint, over the network. The vulnerability is triggered automatically because the device performs no authentication checks when this file is accessed. Simply interacting with this path is sufficient to gain control; the bug is not triggered by internal device processes or user-initiated actions, but rather by external network requests.

Is my device at risk if it is not on the internet?

Halo Surface Signal indicates that StreamerMAX MK II units are frequently placed at network edges for remote access, making them common targets. However, the risk is highest for devices reachable over the public internet. If your device is restricted to a private, internal network without external access, the likelihood of a remote attacker reaching the vulnerable endpoint is reduced, though it remains a concern for internal lateral movement.

What should I do if I use StreamerMAX MK II?

Your first step is to conduct an inventory to identify all StreamerMAX MK II devices in your environment and verify their firmware versions, as this issue affects firmware 0.8.5 through 1.0.3. Determine which teams are responsible for these assets, assess their network reachability, and prioritize those that are internet-facing. Coordinate with your technical leads to manage these devices securely until a fix can be applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.