CVE-2025-63223
CRITICAL
INFO
Priority: 0.08
BB Relevance:
80/100
Published: 2025-11-19
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| axeltechnology | streamermax_mk_ii_firmware | 0.8.5 – 1.0.3 |
References & Advisories (2)
Product
Exploit
Mitigation
Third Party Advisory