CVE-2025-25038 MiniDVBLinux Root Command Injection

What is CVE-2025-25038?

CVE-2025-25038 is a critical command injection vulnerability in MiniDVBLinux, published on 20 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.

Weakness: CWE-78

Which versions are affected by CVE-2025-25038?

It affects 1 product.

Products include Minidvblinux Minidvblinux.

How do I fix CVE-2025-25038?

No fix has been published for CVE-2025-25038 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-25038 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25038 exists.

Other vulnerabilities in MiniDVBLinux

• CVE-2022-50691 MiniDVBLinux 5.4 Remote Root Command Execution via commands.sh Critical 9.3
• CVE-2023-53771 MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup Critical 9.3
• CVE-2023-53770 MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint High 8.7
• CVE-2023-53772 MiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page High 8.7
• CVE-2023-53773 MiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv_action.sh High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r3xp-pwxv-p43m.