EUVD-2025-18780
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.
Analysis
MiniDVBLinux version 5.4 and earlier contains an unauthenticated OS command injection in the web-based management interface. The DVB streaming platform fails to sanitize user input before passing it to operating system commands, enabling remote attackers to execute arbitrary commands on the media server.
Technical Context
The web management interface passes user-supplied input directly to system commands without sanitization. MiniDVBLinux is used for DVB (Digital Video Broadcasting) streaming. The web interface is typically exposed on the local network for stream management.
Affected Products
['MiniDVBLinux <= 5.4']
Remediation
Update MiniDVBLinux or restrict web interface access to trusted management stations. Implement input sanitization on all web endpoints.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today