PT-2025-47470 · Axel Technology · Streamermax Mk Ii

Published 2025-11-19 · Updated 2025-11-24 · CVE-2025-63223

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Axel Technology StreamerMAX MK II versions 0.8.5 through 1.0.3

Description The software contains a Broken Access Control issue because of missing authentication. This affects the /cgi-bin/gstFcgi.fcgi API endpoint. An unauthenticated remote attacker can list user accounts, create new administrative users, delete users, and modify system settings, potentially leading to full device compromise.

Recommendations Update firmware to a version later than 1.0.3.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-63223

Affected Products

Streamermax Mk Ii

References · 8

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control · Exploit
• https://osv.dev/vulnerability/CVE-2025-63223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63223 · Security Note
• https://axeltechnology.com · Note
• https://t.me/cveNotify/143387 · Telegram Post
• https://t.me/cveNotify/143468 · Telegram Post
• https://twitter.com/CVEnew/status/1991187305558913153 · Twitter Post
• https://twitter.com/cracbot/status/1992911134505255316 · Twitter Post