CVE-2019-25251: Teradek Vidiu Firmware

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'url' and 'xml_url'. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary destinations.

Affected products

• Teradek Vidiu Firmware: version 2.4.10 only; version 3.0.2 only; version 3.0.3 only
• Teradek Vidiu Mini Firmware: version 2.4.10 only; version 3.0.2 only; version 3.0.3 only
• Teradek Vidiu Pro Firmware: version 2.4.10 only; version 3.0.2 only; version 3.0.3 only

Published 2025-12-24. Last modified 2026-06-17.