Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Blackmagic ATEM Mini Pro 2.7 allows remote control without password

CVE-2025-57440 · published 1 year ago
Summary

The Blackmagic ATEM Mini Pro 2.7 has a hidden feature that lets anyone on the same network control the device without a password. This means someone could potentially turn off the device, delete its settings, or even erase the recorded videos. To fix this, update the device to the latest software version.

Original advisory text
The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaming, recording, formatting storage d...
The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaming, recording, formatting storage devices, and system reboot. This interface, referred to as the "ATEM Ethernet Protocol 1.0", provides complete device control without requiring credentials or encryption. An attacker on the same network (or with remote access to the exposed port) can exploit this interface to execute arbitrary streaming commands, erase disks, or shut down the device - effectively gaining full remote control.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published22 Sep 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-57440 · NVD
Track software like this
Free during beta