CVE-2025-63952
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro...
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
- Record
CVE-2025-63952- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2025-198970
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
- Record
EUVD-2025-198970- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qf6c-fm2q-4fvw
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro...
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
- Record
GHSA-qf6c-fm2q-4fvw- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
- Record
CVE-2025-63952- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-05
Affected products
- magewell pro convert 12g sdi 4k plus firmware
- magewell pro convert aes67 firmware
- magewell pro convert audio dx firmware
- magewell pro convert for ndi to aio firmware
- magewell pro convert for ndi to hdmi 4k firmware
- magewell pro convert for ndi to hdmi firmware
- magewell pro convert for ndi to sdi firmware
- magewell pro convert hdmi 4k plus firmware
- magewell pro convert hdmi plus firmware
- magewell pro convert hdmi tx firmware
- magewell pro convert sdi 4k plus firmware
- magewell pro convert sdi plus firmware
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-63952 is a medium vulnerability (CVSS 5.7) in Magewell Pro Convert 12g Sdi 4k Plus Firmware, published November 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.