CVE-2023-53771
CriticalSummary
MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can send crafted POST requests to the system setup endpoint with modified SYSTEM_PASSWORD parameters to reset root credentials.
Risk Assessment
The risk for the organization is complete loss of control over the system, as an attacker can gain administrator access and take over the device.
Recommendation
It is recommended to immediately update the software to a version that fixes this vulnerability and restrict access to the admin panel to trusted networks only.
Original NVD description (English source)
MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can send crafted POST requests to the system setup endpoint with modified SYSTEM_PASSWORD parameters to reset root credentials.