CVE-2025-25038: Minidvblinux

Critical severity, CVSS 9.8. EPSS: 5.6% chance of exploitation in the next 30 days.

An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.

Affected products

• Minidvblinux Minidvblinux: up to and including 5.4

Published 2025-06-20. Last modified 2026-06-17.