MiniDVBLinux vulnerabilities
We track 6 vulnerabilities in MiniDVBLinux products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on December 30, 2025.
Latest MiniDVBLinux vulnerabilities
- 9.8 Critical severity
MiniDVBLinux: Improper Neutralization of Special Elements used in an OS Command
MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command
- 9.8 Critical severity
Simple VideoDiskRecorder Protocol SVDRP…: Missing Authentication for Critical Functionality
MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems. Attackers can send crafted SVDRP commands through the svdrpsend.sh script to execute messages and pote
- 7.5 High severity
MiniDVBLinux: Improper Limitation of a Pathname to a Restricted Directory
MiniDVBLinux 5.4 contains an arbitrary file disclosure vulnerability that allows attackers to read sensitive system files through the 'file' GET parameter. Attackers can exploit the about page by supplying file paths to disclose arbitrary file contents on the
- 9.8 Critical severity
MiniDVBLinux Change Root Password PoC: Missing Authentication for Critical Functionality
MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can send crafted POST requests to the system setup endpoint with modified SYSTEM_PASSWORD parameters to
- 7.5 High severity
MiniDVBLinux(TM) Distribution (MLD): Password in Configuration File
MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GET
- 9.8 Critical severity
MiniDVBLinux: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker c