CVE-2025-7202

The Elgato Key Lights contain a Cross-Site Request Forgery (CSRF) vulnerability because HTTP requests to the light's internal web server lack anti-CSRF tokens or origin validation [1]. This allows an attacker to perform actions on the device without the user's consent.

An attacker can exploit this by hosting a malicious webpage that, when visited by a victim on the same local network, sends crafted HTTP requests to the light's IP address. The requests can change the light's state, such as turning it on or off, or adjusting brightness and color [1]. No authentication is required beyond network access.

Successful exploitation gives the attacker full control over the lights, potentially causing disruption or annoyance. The impact is limited to control of the lighting device; no further network compromise is indicated [1].

Users should verify they are running the latest firmware for their Elgato Key Light products. Applying vendor updates can prevent this CSRF attack [1].