CVE-2025-25038

An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.

• CWE-78

• https://cxsecurity.com/issue/WLB-2022100039Third Party Advisory
• https://packetstormsecurity.com/files/168744/Third Party Advisory
• https://vulncheck.com/advisories/minidvblinux-command-injectionThird Party Advisory
• https://www.exploit-db.com/exploits/51096Exploit, Third Party Advisory, VDB Entry
• https://www.fortiguard.com/encyclopedia/ips/52454Third Party Advisory
• https://www.minidvblinux.deProduct
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.phpExploit, Third Party Advisory

Published

Jun 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2503An improper permission handling vulnerability was reported i…7.1
• CVE-2025-25032IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4,…7.5
• CVE-2025-25034A PHP object injection vulnerability exists in SugarCRM vers…9.3
• CVE-2025-25035Improper Neutralization of Input During Web Page Generation …7.3
• CVE-2025-25036Improper Restriction of XML External Entity Reference vulner…6.8
• CVE-2025-25037An information disclosure vulnerability exists in Aquatronic…9.3
• CVE-2025-25039A vulnerability in the web-based management interface of HPE…8.8
• CVE-2025-2504Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-25040A vulnerability has been identified in the port ACL function…3.3
• CVE-2025-25041A vulnerability in the HPE Aruba Networking Virtual Intranet…5.5
• CVE-2025-25042A vulnerability in the AOS-CX REST interface could allow an …4.3
• CVE-2025-25044IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cr…5.4