CVE-2019-25252 MEDIUM

CVE-2019-25252: Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change

Vendor Teradek
Product VidiU Pro
Weakness CWE-352 · CSRF
Published December 24, 2025
Last update March 5, 2026

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.

Key dates

02Disclosure timeline

December 24, 2025 CVE published
March 5, 2026 Record updated