EUVD-2025-21036CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
4Description
An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console component (default port 23423). The checkStreamUrl method accepts a VIDEO parameter that is passed unsanitized to a call to cmd.exe, enabling arbitrary command execution under the privileges of the web server. No authentication is required to exploit this issue, as the REST API is exposed by default and lacks access controls.
Analysis
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/action API endpoint. The checkStreamUrl method passes the VIDEO parameter directly to cmd.exe without sanitization, enabling remote code execution on the media server.
Technical Context
The /rest/action endpoint's checkStreamUrl method accepts a VIDEO parameter and passes it unsanitized to cmd.exe for stream validation. An attacker can inject arbitrary Windows commands through this parameter. The console component listens on port 23423 by default.
Affected Products
['Serviio Media Server 1.4 through 1.8 (Windows)']
Remediation
Update Serviio to the latest version. Restrict console port access (23423) to localhost. Run Serviio as a limited user. Block external access to Serviio management ports.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today