CVE-2025-63223

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-63223
The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control Exploit Third Party Advisory Mitigation
https://www.axeltechnology.com/ Product
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control Exploit Third Party Advisory Mitigation
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:axeltechnology:streamermax_mk_ii_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:axeltechnology:streamermax_mk_ii:-:*:*:*:*:*:*:*
History

15 Jan 2026, 19:38

Type Values Removed Values Added
References () https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control - () https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control - Exploit, Third Party Advisory, Mitigation
References () https://www.axeltechnology.com/ - () https://www.axeltechnology.com/ - Product
First Time Axeltechnology
Axeltechnology streamermax Mk Ii
Axeltechnology streamermax Mk Ii Firmware
CPE cpe:2.3:h:axeltechnology:streamermax_mk_ii:-:*:*:*:*:*:*:*
cpe:2.3:o:axeltechnology:streamermax_mk_ii_firmware:*:*:*:*:*:*:*:*

20 Nov 2025, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-284
References () https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control - () https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control -

19 Nov 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-19 16:15

Updated : 2026-01-15 19:38

NVD link : CVE-2025-63223

Mitre link : CVE-2025-63223

CVE.ORG link : CVE-2025-63223

JSON object : View

Products Affected

axeltechnology

  • streamermax_mk_ii_firmware
  • streamermax_mk_ii
CWE
CWE-284

Improper Access Control