Avideo EUVD-2026-13575

WWBN AVideo versions 25.0 and below deployed using official Docker files (docker-compose.yml, env.example) without overriding the SYSTEM_ADMIN_PASSWORD environment variable. Attacker performs unauthenticated remote login with default credentials admin:password. No victim interaction required.

The CVSS score of 8.1 (High) reflects network-based exploitation with high attack complexity, no privileges required, and high impact across confidentiality, integrity, and availability. The 'AC:H' (High Complexity) designation likely accounts for the requirement that operators must fail to change defaults, though this is common in quick-start, demo, and automated deployment scenarios. Real-world risk is substantial for internet-facing instances deployed using official Docker files without configuration review, particularly in development, staging, or proof-of-concept environments where security hardening is often deferred. The combination of administrative access, RCE potential via file uploads, and the prevalence of default-credential scanning in automated attack campaigns creates a realistic exploitation pathway. While no EPSS score or KEV status is provided, the straightforward nature of default credential exploitation, combined with publicly documented fix commits (2075fac1a51f21fab5d8592235a095aa354a9de6) that reveal the vulnerability details, increases discoverability for threat actors. Organizations using Docker-based AVideo deployments should prioritize this as a critical remediation item.

An attacker performs reconnaissance scanning for internet-facing AVideo instances, identifying them by HTTP response signatures or login page characteristics. Upon discovering the login interface, the attacker attempts authentication using the default credentials 'admin:password', gaining immediate administrative access to instances deployed without credential customization. With administrative privileges, the attacker uploads a malicious PHP web shell disguised as a video file or plugin, enabling remote code execution on the underlying Docker container and potential lateral movement to connected infrastructure or exfiltration of user data and stored video content.