CVE-2025-25038

The web interface of the MiniDVBLinux system does not perform proper validation or sanitization of data supplied by users before passing it to operating system commands. An attacker can inject malicious commands through a specially crafted HTTP request, which will be executed by the system without any authentication mechanism. The vulnerability is classified as CWE-78 (OS Command Injection) and requires no privileges or user interaction. The Shadowserver Foundation has documented evidence of active exploitation of this vulnerability in production environments.

An attacker gains the ability to execute arbitrary commands with root privileges, leading to complete takeover of the device — including reading and modifying data, installing malware, and conducting further lateral movement across the network.

Patches available from the vendor should be applied according to the references. Due to the lack of authentication mechanism as a protective layer, vulnerable devices should not be directly accessible from the Internet — they should be isolated behind a firewall or segmented on the network until updates are deployed.

MiniDVBLinux version 5.4 and earlier