CSRF in Magewell Pro Convert 12g Sdi 4k Plus
CVE-2025-63952
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.002 (5.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N.
Affected products
- Magewell Pro_convert_12g_sdi_4k_plus
- Magewell Pro_convert_12g_sdi_4k_plus_firmware — versions 1.2.213
- Magewell Pro_convert_aes67
- Magewell Pro_convert_aes67_firmware — versions 1.2.213
- Magewell Pro_convert_audio_dx
- Magewell Pro_convert_audio_dx_firmware — versions 1.2.213
- Magewell Pro_convert_for_ndi_to_aio
- Magewell Pro_convert_for_ndi_to_aio_firmware — versions 1.2.213
- Magewell Pro_convert_for_ndi_to_hdmi
- Magewell Pro_convert_for_ndi_to_hdmi_4k
Weakness classification (CWE)
References
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-63952?
- CVE-2025-63952 is a medium-severity vulnerability in Magewell Pro Convert 12g Sdi 4k Plus, classified under Cross-Site Request Forgery (CSRF). CVSS score: 5.7/10. Published 2025-11-24.
- How severe is CVE-2025-63952?
- Medium severity. CVSS v3 base score is 5.7 out of 10.