CSRF in Videoflow Ltd. Digital Video Protection
CVE-2018-25310
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting a cross-site request forgery flaw in the web management interface. Attackers with valid credentials can leverage the CSRF vulnerability to inject and execute system commands through the Tools > System > Shell interface, gaining root-level access to the device.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Videoflow Ltd. Digital Video Protection — versions 2.10, 1.40.0.15, 2.10.0.5
Weakness classification (CWE)
References
- ExploitDB-44387 (exploit)
- Vulnerability Advisory (vendor-advisory)
- VulnCheck Advisory: VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution (third-party-advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
Frequently asked questions
- What is CVE-2018-25310?
- CVE-2018-25310 is a medium-severity vulnerability in Videoflow Ltd. Digital Video Protection, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2026-04-29.
- How severe is CVE-2018-25310?
- Medium severity. CVSS v3 base score is 4.3 out of 10.