PT-2025-52457 · Avideo · Avideo

Valentin Lobstein · Published 2025-12-19 · Updated 2025-12-22 · CVE-2025-34433

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1

Description The software contains an unauthenticated remote code execution issue resulting from predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to recover the salt. This recovered salt can be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, leading to arbitrary code execution as the web server user. The vulnerable function is not specified.

Recommendations Update to version 20.1 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-34433

Affected Products

Avideo

References · 9

• 🔥 https://chocapikk.com/posts/2025/avideo-security-vulnerabilities · Exploit
• https://github.com/WWBN/AVideo/commit/a2bdbff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34433 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34433 · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/4a53ab2 · Note
• https://vulncheck.com/advisories/avideo-unauthenticated-rce-via-predictable-installation-salt · Note
• https://twitter.com/CVEnew/status/2002099148557070690 · Twitter Post
• https://twitter.com/SecAideInfo/status/2003047253426987148 · Twitter Post
• https://twitter.com/0dayPublishing/status/2002045147232575545 · Twitter Post