Overview
CVE-2025-63223 details a critical security vulnerability affecting Axel Technology StreamerMAX MK II devices. Specifically, firmware versions 0.8.5 to 1.0.3 are susceptible to a Broken Access Control flaw. This vulnerability stems from the lack of authentication requirements on the /cgi-bin/gstFcgi.fcgi endpoint. This allows unauthenticated remote attackers to perform sensitive actions, potentially leading to complete device compromise.
Technical Details
The vulnerability lies in the missing authentication checks on the /cgi-bin/gstFcgi.fcgi endpoint. By sending crafted requests to this endpoint, an attacker can bypass intended access controls and execute privileged operations without valid credentials. These operations include:
- Listing user accounts
- Creating new administrative users
- Deleting users
- Modifying system settings
The ability to create administrative users and modify system settings makes this vulnerability particularly severe, as it grants the attacker full control over the StreamerMAX MK II device.
CVSS Analysis
Currently, the CVSS score and severity for CVE-2025-63223 are listed as N/A. However, given the potential for full device compromise via unauthenticated access, it is highly likely that a CVSS score will be assigned reflecting a Critical severity level once officially calculated and released by NIST. Based on the details available, the CVSS score will likely be in the range of 9.0 – 10.0 due to the remote, unauthenticated nature of the vulnerability and the potential for complete system takeover.
Possible Impact
The exploitation of CVE-2025-63223 can have severe consequences. A successful attack could lead to:
- Complete device compromise: Attackers gain full control of the StreamerMAX MK II device.
- Data breach: Sensitive data stored on the device could be exposed.
- Denial of service: The device’s functionality can be disrupted, preventing legitimate users from accessing streaming services.
- Lateral movement: If the StreamerMAX MK II is part of a larger network, attackers could potentially use it as a foothold to compromise other systems.
- Supply chain attacks: Compromised devices could be used as part of larger supply chain attacks if the streaming media is used for critical infrastructure, monitoring or safety systems.
Mitigation or Patch Steps
The primary mitigation strategy is to update the StreamerMAX MK II firmware to a version that addresses this vulnerability. Contact Axel Technology directly or visit their website for the latest firmware updates and security advisories.
Recommended Steps:
- Check your firmware version: Determine the firmware version of your StreamerMAX MK II device.
- Apply the update: If your firmware version is between 0.8.5 and 1.0.3, immediately apply the available patch from Axel Technology.
- Network Segmentation: Isolate the StreamerMAX MK II on a segmented network to limit the impact of a potential breach.
- Monitor Network Traffic: Monitor network traffic to and from the device for suspicious activity.
- Disable Remote Access: If possible, disable remote access to the device.
References
GitHub – CVE-2025-63223 Vulnerability Research
Axel Technology Website
