CVE-2025-34101

An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console component (default port 23423). The checkStreamUrl method accepts a VIDEO parameter that is passed unsanitized to a call to cmd.exe, enabling arbitrary command execution under the privileges of the web server. No authentication is required to exploit this issue, as the REST API is exposed by default and lacks access controls.

• CWE-20
• CWE-78
• CWE-306

• https://fortiguard.fortinet.com/encyclopedia/ips/44042
• https://packetstorm.news/files/id/142387
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/serviio_checkstreamurl_cmd_exec.rb
• https://vulncheck.com/advisories/serviio-media-server-unauthenticated-command-injection
• https://www.exploit-db.com/exploits/42023
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.php

Published

Jul 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34096A stack-based buffer overflow vulnerability exists in Easy F…9.3
• CVE-2025-34097An unrestricted file upload vulnerability exists in ProcessM…8.6
• CVE-2025-34098A path traversal vulnerability exists in Riverbed SteelHead …7.1
• CVE-2025-34099An unauthenticated command injection vulnerability exists in…9.3
• CVE-2025-3410A vulnerability classified as critical was found in mymagicp…8.8
• CVE-2025-34100An unrestricted file upload vulnerability exists in BuilderE…9.3
• CVE-2025-34102A remote code execution vulnerability exists in CryptoLog (P…9.3
• CVE-2025-34103An unauthenticated command injection vulnerability exists in…9.3
• CVE-2025-34104An authenticated remote code execution vulnerability exists …9.4
• CVE-2025-34105A stack-based buffer overflow vulnerability exists in the bu…10
• CVE-2025-34106A buffer overflow vulnerability exists in PDF Shaper version…8.4
• CVE-2025-34107A buffer overflow vulnerability exists in the WinaXe FTP Cli…8.7