CVE-2025-4009

What it actually does

CVE-2025-4009 is a network-accessible command injection vulnerability in the Evertz SDVN 3080ipx-10G web management interface, specifically the PHP endpoint feature-transfer-import.php in the webEASY/ewb-based interface exposed over HTTP port 80. An attacker can submit crafted input that is interpreted by the underlying operating system, resulting in arbitrary command execution with elevated, root-level privileges on the appliance. Because the device controls high-bandwidth video switching fabric functions, successful exploitation can affect device configuration, switching behavior, media transport, and availability.

Why it matters to the business

Successful exploitation can give an unauthenticated remote attacker full control of an affected video switching appliance, allowing them to disrupt media streaming, alter routing or configuration, interfere with captions or transmitted media, install persistence, pivot into adjacent broadcast or production networks, or render the device unavailable. The risk is elevated because the vulnerability is described as weaponized and has a high EPSS score of 0.74956, indicating a meaningful likelihood of exploitation activity even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed Evertz SDVN 3080ipx-10G web management interface, typically reachable over HTTP on port 80. They then send a crafted request to the vulnerable feature-transfer-import.php endpoint. Malicious input supplied to the import functionality is passed unsafely to an operating system command by the PHP/webEASY application. The injected command executes as root on the appliance, allowing the attacker to run reconnaissance commands, modify configuration, create files, download tooling, disrupt switching operations, or establish persistence. If the management interface is internet-accessible or reachable from a less-trusted network, exploitation can be performed remotely without user interaction; where authentication is required, attackers may pair this issue with the separately described authentication-bypass flaw affecting the same interface family.

How to fix it

Upgrade the affected Evertz SDVN 3080ipx-10G firmware/software to a vendor-provided fixed release as soon as one is available and confirm with Evertz support advisories for the exact corrected version applicable to the device model and deployment. If an immediate upgrade is not possible, remove the web management interface from internet and untrusted network exposure, restrict access to a dedicated management network or VPN, enforce source-IP allowlisting, and block direct access to HTTP port 80 from non-administrative networks. Disable or firewall the vulnerable endpoint if operationally feasible. Monitor and harden administrative access, rotate credentials and secrets stored or used on the appliance after remediation, and consider rebuilding/reimaging devices where exploitation is suspected because successful exploitation grants root-level control.

How to confirm the fix worked

Confirm exposure by inventorying Evertz SDVN 3080ipx-10G appliances and checking whether the web management interface is reachable on TCP port 80 from untrusted networks. Verify whether /feature-transfer-import.php is accessible and whether the installed firmware/software version is listed by Evertz as fixed. After remediation, validate that the management interface is reachable only from approved management networks, the vulnerable endpoint is no longer exploitable, and unauthenticated requests to administrative functions are rejected. Use vulnerability scanning only with safe, non-destructive checks; avoid testing arbitrary command execution on production broadcast devices unless coordinated with operations teams.

Typical attack path

1. Scan for exposed Evertz SDVN 3080ipx-10G or webEASY/ewb web management interfaces on HTTP port 80.
2. Confirm the presence of the vulnerable management endpoint, especially /feature-transfer-import.php.
3. Send a crafted HTTP request containing shell metacharacters or command payloads to the vulnerable import function.
4. Achieve root-level command execution on the appliance.
5. Run reconnaissance commands to identify firmware, network interfaces, routes, credentials, and connected media switching configuration.
6. Modify device configuration, disrupt video switching, alter media-related behavior, or deploy additional tools for persistence and lateral movement.
7. Use the compromised appliance as a foothold into adjacent management, broadcast, or production networks.

How to detect it

Review HTTP access logs, reverse-proxy logs, firewall logs, packet captures, and any available Evertz appliance audit or system logs for requests to the vulnerable endpoint /feature-transfer-import.php. Prioritize investigation of unauthenticated or unexpected requests from non-management IP addresses, internet sources, or unusual geographic locations. Look for command-injection characters and payload patterns in query strings, POST bodies, multipart filenames, or form fields, including semicolons, pipes, backticks, command substitution, URL-encoded shell metacharacters, and commands such as id, whoami, uname, curl, wget, nc, busybox, sh, bash, chmod, or crontab. On the appliance, inspect for unexpected files in web-writable or temporary directories, modified startup scripts, unusual cron entries, new users or SSH keys, outbound connections, and child processes spawned by the web server/PHP runtime. Because successful exploitation executes as root, absence of application-level errors does not prove safety; correlate web requests with system process, file, and network artifacts around the same timestamps.

• /feature-transfer-import.php
• feature-transfer-import.php
• GET /feature-transfer-import.php
• POST /feature-transfer-import.php
• %3B
• %7C
• %60
• %24%28
• ;id
• ;whoami
• ;uname
• |id
• |whoami
• |uname
• `id`
• `whoami`
• $(id)
• $(whoami)
• /bin/sh
• /bin/bash
• busybox
• wget
• curl
• nc
• netcat
• chmod +x
• crontab
• /tmp/
• /var/tmp/
• /dev/shm/
• webEASY
• ewb

What your security team should do

• Immediately identify all Evertz SDVN 3080ipx-10G appliances and determine whether their web management interfaces are exposed on TCP port 80.
• Prioritize remediation because exploitation is weaponized and EPSS is high, even though the vulnerability is not currently in CISA KEV.
• Apply the vendor-provided fixed firmware/software release or obtain the applicable patched version directly from Evertz if public fixed-version data is unavailable.
• Restrict management access to trusted administrative networks or VPN-only paths and block internet access to the device web interface.
• Search historical web, proxy, firewall, and appliance logs for access to /feature-transfer-import.php, especially requests containing shell metacharacters or command-execution patterns.
• If suspicious activity is found, treat the appliance as fully compromised, preserve forensic evidence, rotate credentials, review configuration integrity, and rebuild or reimage according to vendor guidance.
• Monitor adjacent network segments for lateral movement from the appliance, including outbound connections to unfamiliar internal or external hosts.