Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manipulate stream settings, including changing video modes and possibly altering device functionality. No credentials or authentication mechanisms are required to interact with the Telnet interface.
CVE-2025-57432
CVSS base score
9.8 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-306
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
blackmagicdesign web presenter hd firmware
blackmagicdesign web presenter 4k firmware
References
- github.com Exploit, Third Party Advisory
- www.blackmagicdesign.com Product
- github.com Exploit, Third Party Advisory