← back
CVE-2025-25038

MiniDVBLinux Root Command Injection

CVSS 9.3 CRITICALEPSS 5.3%CWE-78
An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
MiniDVBLinux · MiniDVBLinux
public PoCs found — 4
cve_referencecxsecurity.com/issue/WLB-2022100039unverifiedcve_referencepacketstormsecurity.com/files/168744/unverifiedcve_referencewww.exploit-db.com/exploits/51096unverifiedcve_referencewww.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.phpunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://cxsecurity.com/issue/WLB-2022100039https://packetstormsecurity.com/files/168744/https://vulncheck.com/advisories/minidvblinux-command-injectionhttps://www.exploit-db.com/exploits/51096https://www.fortiguard.com/encyclopedia/ips/52454https://www.minidvblinux.dehttps://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.php