Streamax Crocus CVE-2025-11914

No vendor-released patch has been identified at time of analysis, and the vendor has not responded to disclosure attempts. Immediate mitigations include: (1) Restrict network access to the /DeviceFileReport.do endpoint using firewall rules or reverse proxy authentication to limit exposure to trusted administrative networks only; (2) Implement input validation on the FilePath parameter to reject path traversal sequences such as ../, .., or absolute paths, allowing only whitelisted filename patterns; (3) Configure the application to serve files from a restricted directory with file system permissions that prevent access outside the intended download folder; (4) Monitor file access logs for suspicious path traversal attempts (patterns containing ../ or system directory paths). If the product is no longer actively maintained, consider evaluating alternative file management solutions or implementing a Web Application Firewall (WAF) rule set to detect and block path traversal exploitation attempts on this endpoint.