CVE-2019-25251

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Dec 24, 2025

CISA due date

—

The record

Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'url' and 'xml_url'. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary destinations.

Affected packages

Ecosystem	Package	Introduced	Fixed