CVE-2025-4009

CVE-2025-4009 is an unauthenticated arbitrary command injection (CWE-77) in feature-transfer-import.php, part of the PHP-based web management interface (built on Evertz's webEASY, or 'ewb', SDK) exposed on TCP port 80 of the Evertz SDVN 3080ipx-10G video switching fabric. A remote attacker who can reach the management interface triggers the flaw with a crafted request to that endpoint and gains arbitrary command execution with root privileges on the device. With root access, an attacker could interrupt media streaming, modify media being streamed, or alter generated closed captions, making this high-impact for broadcast operations. Any organization running an SDVN 3080ipx-10G whose management interface is reachable by untrusted users is affected; the same interface also carries a companion command injection (CVE-2025-10364) and an authentication bypass (CVE-2025-10365). No public PoC or confirmed in-the-wild exploitation is known, but the EPSS score of 71.4% (99th percentile) indicates a high probability of exploitation within 30 days.

What to do: Restrict access to TCP port 80 on the management interface to trusted management networks and remove any internet exposure until patched. Contact Evertz for updated firmware addressing the feature-transfer-import.php flaw, and plan to remediate the companion issues CVE-2025-10364 (export-endpoint command injection) and CVE-2025-10365 (authentication bypass) at the same time. Review device HTTP logs for unexpected requests to feature-transfer-import.php as an indicator of probing or exploitation attempts.