PT-2025-38761 · Blackmagic Design · Atem Mini Pro

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-57440

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Blackmagic ATEM Mini Pro version 2.7

Description The Blackmagic ATEM Mini Pro 2.7 device exposes an undocumented Telnet service on TCP port 9993. This service accepts unauthenticated plaintext commands, allowing control over streaming, recording, storage device formatting, and system reboot. The interface, known as the "ATEM Ethernet Protocol 1.0", grants complete device control without authentication or encryption. An attacker on the same network or with remote access to the exposed port can execute arbitrary streaming commands, erase disks, or shut down the device, gaining full remote control. The API endpoint is accessible via TCP port 9993.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-57440

Affected Products

Atem Mini Pro

References · 4

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57440 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57440 · Security Note
• https://blackmagicdesign.com · Note
• https://twitter.com/CVEnew/status/1970184006302900322 · Twitter Post