Streamax Crocus CVE-2025-11911

No vendor-released patch is available at this time. Immediate mitigation requires network-level controls: restrict access to the /DeviceFault.do endpoint to trusted internal networks only, implement Web Application Firewall (WAF) rules to block SQL injection patterns in the sortField parameter (e.g., detect and reject requests containing SQL keywords like UNION, SELECT, ORDER, or special characters such as single quotes and semicolons in that parameter), and enforce strong authentication with multi-factor authentication for all administrative accounts. At the application level, if feasible, disable or remove the vulnerable Query function entirely if it is not critical to operations, or implement input validation that strictly whitelists allowed sortField values (e.g., only permit column names from a predefined safe list). Monitor logs for suspicious SQL syntax in /DeviceFault.do requests and unusual database query patterns. These compensating controls trade operational convenience for security; strict WAF rules may generate false positives requiring tuning. Contact Streamax directly to request a patched version or migration path to an alternative product, as the vendor's lack of response to early disclosure suggests potentially poor security maintenance practices.