Media Server EUVD-2025-18173

CVSS 8.6 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H indicates a network-accessible vulnerability requiring no authentication or user interaction with low attack complexity—all factors that increase real-world exploitability. The scoring reflects: (1) Confidentiality impact (L) from unauthorized data access, (2) Integrity impact (I) from configuration modification, and (3) High availability impact from potential DoS through service reconfiguration. The combination of information disclosure (GET) and configuration modification (POST) capabilities creates a compounded threat: attackers can first enumerate the environment, then degrade availability by modifying port bindings or redirecting logs. Without confirmed EPSS percentile, KEV/CISA status, or public POC data from provided sources, conservative assessment suggests this is a HIGH PRIORITY vulnerability for any organization running the affected service on internet-facing or untrusted networks. The low AC and PR:N rating alone justifies immediate patching. If EPSS >0.90 or KEV status confirmed, this escalates to CRITICAL priority requiring emergency response.

An attacker performs reconnaissance by sending unauthenticated HTTP GET requests to the service's API endpoint from the public internet (AV:N), discovering sensitive configuration data such as database connection strings, internal IP addresses, or system credentials without providing any credentials (PR:N). Once information is gathered, the attacker sends HTTP POST requests to modify the service's log_root_path to point to a non-existent or inaccessible location and changes the listening tcp_port to an already-in-use port (e.g., port 22 on Linux), causing the service to crash or fail to restart (A:H, DoS). This attack requires no user interaction (UI:N), no special network position (AC:L), and works against any exposed instance. If a public POC exists (not confirmed in provided data), exploitation becomes trivial, enabling mass exploitation of all vulnerable instances on the internet. In a cloud environment, an attacker could exploit multiple instances rapidly, causing widespread service disruption.