CVE-2025-34433 AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
Unauthenticated attackers can achieve remote code execution by brute-forcing a predictable installation salt to inject malicious payloads into the notification API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34433?
CVE-2025-34433 is a critical code injection vulnerability in World Wide Broadcast Network AVideo, published on 19 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.
Weakness: CWE-94
Which versions are affected by CVE-2025-34433?
How do I fix CVE-2025-34433?
No fix has been published for CVE-2025-34433 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-34433 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34433 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-hv75-87h9-4p5h.