CVE-2025-25038
published 2025-06-20CVE-2025-25038: An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize…
PriorityP188critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
5.32%
91.6th percentile
An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| minidvblinux | minidvblinux | <= 5.4 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r3xp-pwxv-p43m: An OS command injection vulnerability exists in MiniDVBLinux version 5
ghsa_unreviewed·2025-06-20
CVE-2025-25038 [CRITICAL] CWE-20 GHSA-r3xp-pwxv-p43m: An OS command injection vulnerability exists in MiniDVBLinux version 5
An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device.
VulnCheck
minidvblinux minidvblinux Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2025·CVSS 9.3
CVE-2025-25038 [CRITICAL] minidvblinux minidvblinux Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
minidvblinux minidvblinux Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.
Affected: MiniDVBLinux MiniDVBLinux Distribution (MLD)
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
E
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cxsecurity.com/issue/WLB-2022100039https://packetstormsecurity.com/files/168744/https://vulncheck.com/advisories/minidvblinux-command-injectionhttps://www.exploit-db.com/exploits/51096https://www.fortiguard.com/encyclopedia/ips/52454https://www.minidvblinux.dehttps://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.php
2025-06-20
Published
Exploited in the wild