PT-2025-50267 · Unknown · Minidvblinux

Published 2025-12-09 · Updated 2025-12-19 · CVE-2023-53770

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MiniDVBLinux version 5.4

Description MiniDVBLinux version 5.4 has an issue allowing unauthenticated access to system configuration files. Remote attackers can obtain sensitive system configuration files through a direct object reference. The issue is exploitable by sending a GET request to the backup download endpoint with the parameter action set to getconfig, which retrieves a system configuration archive containing sensitive credentials. The affected API endpoint is '/backup/download'.

Recommendations Apply any available configuration changes to restrict access to the /backup/download endpoint. Restrict access to the getconfig action.

Exploit

Fix

Weakness Enumeration

CWE-260

Related Identifiers

CVE-2023-53770

Affected Products

Minidvblinux

References · 9

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2022-5713.php · Exploit
• 🔥 https://exploit-db.com/exploits/51091 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53770 · Security Note
• https://t.me/cveNotify/146390 · Telegram Post
• https://minidvblinux.de · Note
• https://twitter.com/CVEnew/status/1998732788158329205 · Twitter Post
• https://vulncheck.com/advisories/minidvblinux-unauthenticated-configuration-download-via-backup-endpoint · Note
• https://t.me/CVEtracker/39296 · Telegram Post