CVE-2025-63952

MediumCVSS 5.7

Published: 24/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.

Risk Assessment

An attacker can trick an authenticated user into performing an unwanted action, creating unauthorized accounts and gaining access to the device. The risk affects Magewell Pro Convert devices running version 1.2.213.

Recommendation

Update the device firmware to a version containing a fix if available. Implement CSRF protections such as anti-CSRF tokens and restrict access to the management interface.

Other vulnerabilities in Magewell Pro Convert

CVE-2025-63953Medium
A Cross-Site Request Forgery (CSRF) vulnerability in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.

Original NVD description (English source)

A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS