CVE-2023-53773 MiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv_action.sh
Remote attackers can access live TV screenshots without authentication via the tv_action.sh script in MiniDVBLinux.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-53773?
CVE-2023-53773 is a high-severity missing authorization vulnerability in MiniDVBLinux, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MiniDVBLinux 5.4 contains an unauthenticated vulnerability in the tv_action.sh script that allows remote attackers to generate live stream snapshots through the Simple VDR Protocol. Attackers can request /tpl/tv_action.sh to create and retrieve a live TV screenshot stored in /var/www/images/tv.jpg without authentication.
Weakness: CWE-306
Which versions are affected by CVE-2023-53773?
It affects 1 product.
Products include Minidvblinux Minidvblinux.
How do I fix CVE-2023-53773?
No fix has been published for CVE-2023-53773 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-53773 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53773 exists.
Other vulnerabilities in MiniDVBLinux
- CVE-2022-50691 MiniDVBLinux 5.4 Remote Root Command Execution via commands.sh
- CVE-2023-53771 MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup
- CVE-2025-25038 MiniDVBLinux Root Command Injection
- CVE-2023-53770 MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
- CVE-2023-53772 MiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page
Sources
Also known as GHSA-g24h-8xr2-34q6.