CVE-2025-63952: Magewell Pro Convert 12g Sdi 4k Plus Firmware

Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.

Affected products

• Magewell Pro Convert 12g Sdi 4k Plus Firmware: version 1.2.213 only
• Magewell Pro Convert AES67 Firmware: version 1.2.213 only
• Magewell Pro Convert Audio Dx Firmware: version 1.2.213 only
• Magewell Pro Convert For NDI To Aio Firmware: version 1.2.213 only
• Magewell Pro Convert For NDI To Hdmi 4k Firmware: version 1.2.213 only
• Magewell Pro Convert For NDI To Hdmi Firmware: version 1.2.213 only
• Magewell Pro Convert For NDI To Sdi Firmware: version 1.2.213 only
• Magewell Pro Convert Hdmi 4k Plus Firmware: version 1.2.213 only
• Magewell Pro Convert Hdmi Plus Firmware: version 1.2.213 only
• Magewell Pro Convert Hdmi Tx Firmware: version 1.2.213 only
• Magewell Pro Convert Sdi 4k Plus Firmware: version 1.2.213 only
• Magewell Pro Convert Sdi Plus Firmware: version 1.2.213 only
• Magewell Pro Convert Sdi Tx Firmware: version 1.2.213 only

Published 2025-11-24. Last modified 2026-06-17.