Teradek VidiU Pro Cross-Site Request Forgery Vulnerability Allowing Password Change

A cross-site request forgery (CSRF) vulnerability has been identified in the Teradek VidiU Pro version 3.0.3, as well as in versions 3.0.2 and 2.4.10. This vulnerability allows attackers to change administrative passwords without proper request validation. By crafting malicious web pages that automatically submit password change requests, an attacker can exploit this issue when a logged-in administrator visits the page.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, potentially leading to unauthorized access or actions on behalf of the administrator.

Reproduction

To reproduce this vulnerability, a logged-in administrator must be tricked into visiting a malicious web page that automatically submits a password change request to the Teradek VidiU Pro device. The request must include the new password, the password confirmation, and the username of the administrator.