CVE-2025-57432
📋 TL;DR
Blackmagic Web Presenter version 3.3 exposes an unauthenticated Telnet service on port 9977, allowing remote attackers to manipulate stream settings and potentially alter device functionality without credentials. This affects all users running the vulnerable version of the software.
💻 Affected Systems
- Blackmagic Web Presenter
📦 What is this software?
Web Presenter 4k Firmware by Blackmagicdesign
Web Presenter Hd Firmware by Blackmagicdesign
⚠️ Risk & Real-World Impact
Worst Case
Attackers could completely disrupt video streaming operations, alter critical device settings, or potentially execute arbitrary commands leading to full device compromise.
Likely Case
Unauthorized users will manipulate stream settings, change video modes, and disrupt normal device operation.
If Mitigated
With proper network segmentation and access controls, impact is limited to authorized internal users only.
🎯 Exploit Status
Exploitation requires only basic Telnet knowledge and no special tools or techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.blackmagicdesign.com/
Restart Required: No
Instructions:
Check Blackmagic Design website for security updates. If patch is available, download and apply according to vendor instructions.
🔧 Temporary Workarounds
Block Telnet Port
allBlock access to port 9977 using firewall rules to prevent external and unauthorized internal access.
iptables -A INPUT -p tcp --dport 9977 -j DROP
netsh advfirewall firewall add rule name="Block Web Presenter Telnet" dir=in action=block protocol=TCP localport=9977
Network Segmentation
allIsolate Web Presenter devices on a separate VLAN with strict access controls.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Web Presenter devices from untrusted networks
- Deploy network monitoring to detect and alert on Telnet connections to port 9977
🔍 How to Verify
Check if Vulnerable:
Use Telnet to connect to the device on port 9977: telnet [device_ip] 9977. If connection succeeds without authentication, device is vulnerable.Check Version:
Check device web interface or physical display for firmware version information.Verify Fix Applied:
Attempt Telnet connection to port 9977. Connection should fail or require authentication after remediation.📡 Detection & Monitoring
Log Indicators:
- Telnet connection attempts to port 9977
- Unauthorized configuration changes in device logs
Network Indicators:
- TCP connections to port 9977 from unauthorized sources
- Telnet traffic to Web Presenter devices
SIEM Query:
source_port=9977 OR dest_port=9977 AND protocol=TCP