Description
Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manipulate stream settings, including changing video modes and possibly altering device functionality. No credentials or authentication mechanisms are required to interact with the Telnet interface.
Affected products
blackmagicdesign: web presenter hd firmware; blackmagicdesign: web presenter hd; blackmagicdesign: web presenter 4k firmware; blackmagicdesign: web presenter 4k
References3
- github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-… ExploitThird Party Advisory
- github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-… ExploitThird Party Advisory
- www.blackmagicdesign.com/ Product
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 51 · as of 8 November 2026
- CWE
- CWE-306
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.