Read the docs
TI-2025-03552 Aliases CVE-2025-4009GHSA-4jm8-hmxq-7xq6

Unauthenticated Arbitrary Command Injection in Evertz SDVN

Priority CRITICAL 87CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). CVE-2025-4009 covers the command injection in feature-transfer-import.php CVE-2025-10364 covers the command injection in feature-transfer-export.php Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.74048 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Evertz3080ipx-10Gall versions—No fix listedCNA
EvertzMViP-IIall versions—No fix listedCNA
EvertzcVIPall versions—No fix listedCNA
Evertz7890IXGall versions—No fix listedCNA
EvertzCC Access Serverall versions—No fix listedCNA
Evertz5782XPS-APP-4Eall versions—No fix listedCNA
  • 3080ipx-10G VendorEvertz Affected all versions Fixed in — No fix listed CNA
  • MViP-II VendorEvertz Affected all versions Fixed in — No fix listed CNA
  • cVIP VendorEvertz Affected all versions Fixed in — No fix listed CNA
  • 7890IXG VendorEvertz Affected all versions Fixed in — No fix listed CNA
  • CC Access Server VendorEvertz Affected all versions Fixed in — No fix listed CNA
  • 5782XPS-APP-4E VendorEvertz Affected all versions Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4009
  2. 2026-10-03 Alias added: GHSA-4jm8-hmxq-7xq6

References

Advisory 1

  • TI-2020-14277 EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are… CVSS 3.1HIGH 8.8
  • TI-2025-09502 Authentication Bypass in Evertz SDVN CVSS 4.0CRITICAL 9.3
  • TI-2025-09501 Unauthenticated Arbitrary Command Injection in Evertz SDVN CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences