Paper/Archive/CVE-2023-53771

CVE-2023-53771

MiniDVBLinux MiniDVBLinux Change Root Password PoC — MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup

EPSS 1.0%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 62.0.620 × 2012.4 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can send crafted POST requests to the system setup endpoint with modified SYSTEM_PASSWORD parameters to reset root credentials.

Affected

ProductAffectedFixed inSource

MiniDVBLinux Change Root Password PoC<=5.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/51094 writeupzeroscience.mk/en/vulnerabilities/ZSL-2022-5715.php refminidvblinux.de writeupvulncheck.com/advisories/minidvblinux-unauthenticated-root-password-change-via-system-setup