Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2023-53770

MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint

MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GET request with 'action=getconfig' to retrieve a complete system configuration archive containing sensitive credentials.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Distribution Minidvblinux
Products
Distribution Minidvblinux
CVE-2025-25038

MiniDVBLinux Root Command Injection

An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.

CVSS 4.0 · 9.3 Critical EPSS 5.5% KEV · Not listed
Vendors
Minidvblinux
Products
Minidvblinux
CVE-2023-53774

MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol Remote Code Execution

MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems. Attackers can send crafted SVDRP commands through the svdrpsend.sh script to execute messages and potentially control the video disk recorder remotely.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Minidvblinux
Products
Minidvblinux
CVE-2023-53773

MiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv_action.sh

MiniDVBLinux 5.4 contains an unauthenticated vulnerability in the tv_action.sh script that allows remote attackers to generate live stream snapshots through the Simple VDR Protocol. Attackers can request /tpl/tv_action.sh to create and retrieve a live TV screenshot stored in /var/www/images/tv.jpg without authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Minidvblinux
Products
Minidvblinux
CVE-2023-53772

MiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page

MiniDVBLinux 5.4 contains an arbitrary file disclosure vulnerability that allows attackers to read sensitive system files through the 'file' GET parameter. Attackers can exploit the about page by supplying file paths to disclose arbitrary file contents on the affected device.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed
Vendors
Minidvblinux
Products
Minidvblinux
CVE-2023-53771

MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup

MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can send crafted POST requests to the system setup endpoint with modified SYSTEM_PASSWORD parameters to reset root credentials.

CVSS 4.0 · 9.3 Critical EPSS 1.0% KEV · Not listed
Vendors
Minidvblinux
Products
Minidvblinux
CVE-2022-50691

MiniDVBLinux 5.4 Remote Root Command Execution via commands.sh

MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed
Vendors
Minidvblinux
Products
Minidvblinux