CVE-2022-50691

The command injection vulnerability occurs in the /tpl/commands.sh endpoint, which processes a GET parameter named 'command'. An attacker can send a specially crafted HTTP request containing malicious values of this parameter, which are then executed by the operating system without any validation or authentication. Since commands are executed in the root account context, the attacker gains immediate, full access to the system.

An attacker without any authentication can execute arbitrary system commands with root privileges, which in practice means full takeover of the device, ability to read and modify all data, and further actions on the network.

Patches available from the vendor should be applied according to the references. As an immediate protective measure, it is recommended to isolate MiniDVBLinux devices from public network access and restrict access to the management interface only to trusted hosts using a firewall.

MiniDVBLinux version 5.4