PT-2025-52457 · Avideo · Avideo

Valentin Lobstein · CVE-2025-34433 · Publicado 2025-12-19 · Atualizado 2025-12-22

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1

Description The software contains an unauthenticated remote code execution issue resulting from predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to recover the salt. This recovered salt can be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, leading to arbitrary code execution as the web server user. The vulnerable function is not specified.

Recommendations Update to version 20.1 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-34433

Produtos afetados

Avideo

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34433.json · Exploit
• 🔥 https://chocapikk.com/posts/2025/avideo-security-vulnerabilities · Exploit
• https://github.com/WWBN/AVideo/commit/4a53ab2 · Correção
• https://github.com/WWBN/AVideo/commit/a2bdbff · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2025-34433 · Nota de Segurança
• https://twitter.com/CVEnew/status/2002099148557070690 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-34433 · Aviso do Fabricante
• https://vulncheck.com/advisories/avideo-unauthenticated-rce-via-predictable-installation-salt · Nota
• https://twitter.com/SecAideInfo/status/2003047253426987148 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2002045147232575545 · Publicação no Twitter