CVE-2025-25038

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
MiniDVBLinux	MiniDVBLinux	<= 5.4

References

https://cxsecurity.com/issue/WLB-2022100039Third Party Advisory
https://packetstormsecurity.com/files/168744/Third Party Advisory
https://vulncheck.com/advisories/minidvblinux-command-injectionThird Party Advisory
https://www.exploit-db.com/exploits/51096Exploit, Third Party Advisory, VDB Entry
https://www.fortiguard.com/encyclopedia/ips/52454Third Party Advisory
https://www.minidvblinux.deProduct
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.phpExploit, Third Party Advisory

Timeline

Published: Jun 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-250398.8A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated us CVE-2025-250403.3A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Seri CVE-2025-250415.5A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as CVE-2025-250424.3A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information.CVE-2025-250445.4IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arb CVE-2025-250454.3IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returne CVE-2025-250463.7IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be e CVE-2025-250486.5IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated u CVE-2025-25059.8The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' param CVE-2025-250508.8An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and D CVE-2025-250516.1An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lat CVE-2025-250525.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow.