Critical severity9.8NVD Advisory· Published Nov 19, 2025· Updated Jun 17, 2026
CVE-2025-63223
CVE-2025-63223
Description
The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
30.8.5 to 1.0.3+ 1 more
- (no CPE)range: 0.8.5 to 1.0.3
- (no CPE)
- cpe:2.3:o:axeltechnology:streamermax_mk_ii_firmware:*:*:*:*:*:*:*:*Range: >=0.8.5,<=1.0.3
Patches
Vulnerability mechanics
References
2- github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20ControlnvdExploitMitigationThird Party Advisory
- www.axeltechnology.comnvdProduct
News mentions
0No linked articles in our index yet.