CVE-2018-25310
Authenticated Remote Code Execution in VideoFlow Digital Video Protection DVP 2.10 via CSRF
Publication date: 2026-04-29
Last updated on: 2026-04-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| videoflow | digital_video_protection | 2.10 |
| videoflow | digital_video_protection | 1.40.0.15 |
| videoflow | digital_video_protection | 2.10.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in VideoFlow Digital Video Protection DVP 2.10 and involves an authenticated remote code execution flaw. It allows attackers who already have valid credentials to exploit a cross-site request forgery (CSRF) weakness in the web management interface. By leveraging this CSRF flaw, attackers can inject and execute arbitrary system commands through the Tools > System > Shell interface, ultimately gaining root-level access to the device.
How can this vulnerability impact me? :
The impact of this vulnerability is significant because it allows an attacker with valid credentials to execute arbitrary system commands with root privileges on the affected device. This can lead to full compromise of the device, unauthorized control, potential data theft, disruption of services, and further attacks within the network.
Can you explain this vulnerability to me?
VideoFlow Digital Video Protection DVP version 2.10 contains an authenticated remote code execution vulnerability. This flaw arises from a cross-site request forgery (CSRF) issue in the device's web management interface.
Attackers who have valid credentials can exploit this CSRF vulnerability to inject and execute arbitrary system commands through the Tools > System > Shell interface, gaining root-level access to the device.
Additionally, the device suffers from hard-coded credentials, such as admin:admin and root:videoflow, which further facilitate unauthorized access and exploitation.
How can this vulnerability impact me? :
Exploiting this vulnerability allows an attacker with valid credentials to execute arbitrary system commands remotely with root privileges.
This can lead to full system compromise, giving the attacker complete control over the device and its broadcast functions.
Such control could disrupt live video distribution, compromise network reliability, and potentially allow further attacks within the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of VideoFlow Digital Video Protection (DVP) version 2.10 or affected versions on your network or system.
You can attempt to verify if the device is using default or hard-coded credentials such as admin:admin, oper:oper, private:private, public:public, devel:devel for the web management interface, or root:videoflow for SSH access.
To detect exploitation attempts or verify vulnerability, you might try accessing the web management interface and checking the Tools > System > Shell interface for unauthorized command execution capabilities.
Suggested commands to check for the device and its version might include network scanning tools to identify the device IP and banner grabbing via SSH or HTTP to confirm version and credentials, for example:
- nmap -p 22,80 --script=banner <target-ip> # To identify open ports and service banners
- ssh root@<target-ip> # Attempt to login using hard-coded SSH credentials (root:videoflow)
- curl -u admin:admin http://<target-ip>/ # Attempt to access the web management interface with default credentials
- Check for the presence of the Tools > System > Shell interface in the web UI to confirm vulnerability to command injection via CSRF.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include changing all default and hard-coded credentials on the affected devices to strong, unique passwords to prevent unauthorized access.
Restrict access to the web management interface and SSH services to trusted networks and users only.
Disable or restrict the Tools > System > Shell interface if possible, to prevent command injection via CSRF.
Monitor network traffic and device logs for suspicious activity indicating exploitation attempts.
Apply any available patches or updates from the vendor addressing this vulnerability.