CVE-2025-57441: ATEM Mini Pro Information Disclosure Flaw

CVE-2025-57441 Overview

CVE-2025-57441 is a critical information disclosure vulnerability affecting the Blackmagic ATEM Mini Pro with firmware version 2.7. The vulnerability stems from an unauthenticated Telnet service exposed on port 9990 that allows remote attackers to access sensitive device and stream configuration information without any credentials. Upon establishing a connection, attackers can retrieve a protocol preamble containing video mode settings, routing configuration, input/output labels, the device model identifier, and internal identifiers including the unique device ID.

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and represents a significant reconnaissance opportunity for threat actors planning further attacks against production video switching environments.

Critical Impact

Unauthenticated remote access to sensitive device configuration data enables reconnaissance for targeted attacks against broadcast and video production infrastructure.

Affected Products

• Blackmagic Design ATEM Mini Pro Firmware version 2.7
• Blackmagic Design ATEM Mini Pro hardware device

Discovery Timeline

• September 22, 2025 - CVE-2025-57441 published to NVD
• October 17, 2025 - Last updated in NVD database

Technical Details for CVE-2025-57441

Vulnerability Analysis

The vulnerability exists in the Telnet-based management interface of the ATEM Mini Pro video switcher. The device exposes a network service on TCP port 9990 that provides device information without requiring authentication. When a remote client connects to this port, the device immediately responds with a protocol preamble containing sensitive configuration data.

The exposed information includes video mode configurations (resolution, frame rate settings), routing configurations that reveal how inputs and outputs are mapped, custom labels assigned to inputs and outputs, the device model identifier, and critically, the unique internal device identifier. This information disclosure can be leveraged for device fingerprinting, network mapping, and planning targeted attacks against the broadcast infrastructure.

Root Cause

The root cause of this vulnerability is the implementation of an unauthenticated Telnet service for device management and control. The ATEM Mini Pro firmware version 2.7 lacks proper access controls on the management interface, allowing any network-adjacent or remote attacker (depending on network configuration) to connect and retrieve sensitive device information. The design flaw represents a failure to implement authentication mechanisms before exposing device configuration data.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker with network access to the ATEM Mini Pro device can connect to TCP port 9990 using any Telnet client or raw socket connection. Upon connection, the device automatically transmits the protocol preamble containing sensitive configuration data.

The attack can be performed remotely if the device is exposed to the internet or from any position on the local network. The attacker simply needs to establish a TCP connection to the target port, and the device will respond with the sensitive information without any authentication challenge. This makes the vulnerability trivial to exploit for reconnaissance purposes.

Detection Methods for CVE-2025-57441

Indicators of Compromise

• Unexpected network connections to TCP port 9990 on ATEM Mini Pro devices
• Network scanning activity targeting port 9990 across multiple hosts
• Telnet connection attempts from unauthorized IP addresses to video production equipment
• Unusual outbound data from ATEM devices during non-production hours

Detection Strategies

• Monitor network traffic for connections to port 9990 on ATEM Mini Pro devices using firewall logs or IDS/IPS systems
• Implement network segmentation monitoring to detect unauthorized access attempts to broadcast equipment VLANs
• Deploy network anomaly detection to identify port scanning activities targeting known ATEM device ports
• Configure SIEM alerts for Telnet connection patterns to video production infrastructure

Monitoring Recommendations

• Enable logging on network perimeter devices for all traffic destined to port 9990
• Implement asset inventory tracking for all ATEM Mini Pro devices and monitor their network interfaces
• Conduct periodic network scans to identify any ATEM devices inadvertently exposed to untrusted networks
• Review firewall rules regularly to ensure ATEM management ports are not accessible from unauthorized network segments

How to Mitigate CVE-2025-57441

Immediate Actions Required

• Isolate ATEM Mini Pro devices on dedicated VLANs with restricted network access
• Implement firewall rules to block inbound connections to TCP port 9990 from untrusted networks
• Conduct an audit to identify any ATEM devices exposed to the internet and remediate immediately
• Review network architecture to ensure video production equipment is not accessible from general-purpose networks

Patch Information

At the time of publication, no vendor advisory or official patch has been released by Blackmagic Design for this vulnerability. Organizations should monitor the Blackmagic Design website for firmware updates that may address this security issue. Additional technical details about the vulnerability can be found in the GitHub CVE-2025-57441 Research repository.

Workarounds

• Deploy network access control lists (ACLs) to restrict access to port 9990 to authorized management stations only
• Place ATEM Mini Pro devices behind a VPN or jump host that requires authentication before network access is granted
• Implement network segmentation to isolate broadcast equipment from general corporate networks
• Consider using a dedicated out-of-band management network for video production equipment

# Example firewall rule to restrict access to ATEM management port
# Allow only specific management IP to access port 9990
iptables -A INPUT -p tcp --dport 9990 -s 192.168.10.50 -j ACCEPT
iptables -A INPUT -p tcp --dport 9990 -j DROP