CVE-2025-57441
📋 TL;DR
The Blackmagic ATEM Mini Pro 2.7 exposes sensitive configuration information via an unauthenticated Telnet service on port 9990. Attackers can gather reconnaissance data including device details, video settings, and internal identifiers to plan further attacks. All users of this specific device version are affected.
💻 Affected Systems
- Blackmagic ATEM Mini Pro
📦 What is this software?
Atem Mini Pro Firmware by Blackmagicdesign
⚠️ Risk & Real-World Impact
Worst Case
Attackers use leaked information to execute follow-on attacks like unauthorized stream manipulation, device takeover, or network pivoting to other systems.
Likely Case
Information disclosure enables reconnaissance for targeted attacks, potentially leading to stream hijacking, configuration tampering, or denial of service.
If Mitigated
With proper network segmentation and access controls, impact is limited to information disclosure without direct system compromise.
🎯 Exploit Status
Simple telnet connection to port 9990 reveals information without any authentication or special tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.blackmagicdesign.com/
Restart Required: No
Instructions:
Check Blackmagic Design website for firmware updates addressing CVE-2025-57441. Apply any available patches following vendor instructions.
🔧 Temporary Workarounds
Block Telnet Port
allBlock access to port 9990 using firewall rules to prevent unauthorized connections.
iptables -A INPUT -p tcp --dport 9990 -j DROP
netsh advfirewall firewall add rule name="Block ATEM Telnet" dir=in action=block protocol=TCP localport=9990
Network Segmentation
allIsolate ATEM Mini Pro devices on separate VLANs with strict access controls.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ATEM devices from untrusted networks
- Monitor network traffic to port 9990 for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Connect to device IP on port 9990 using telnet: 'telnet [device_ip] 9990'. If connection succeeds and shows configuration data, device is vulnerable.Check Version:
Check device firmware version through ATEM Software Control interface or device settings menu.Verify Fix Applied:
Attempt telnet connection to port 9990. Connection should fail or show no sensitive information if fixed.📡 Detection & Monitoring
Log Indicators:
- Telnet connection attempts to port 9990
- Unusual outbound connections from ATEM device
Network Indicators:
- TCP connections to port 9990 from unauthorized IPs
- Telnet protocol traffic to ATEM devices
SIEM Query:
source_port=9990 OR destination_port=9990 OR protocol="telnet"