Remote Command Execution in MiniDVBLinux 5.4 via /tpl/commands.sh

Publication date: 2025-12-30

Last updated on: 2025-12-30

Assigner: VulnCheck

Description

MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-30

Last Modified

2025-12-30

Generated

2026-07-06

AI Q&A

2025-12-31

EPSS Evaluated

2026-07-05

NVD

CVE-2022-50691

Affected Vendors & Products

Vendor	Product	Version / Range
minidvblinux	minidvblinux	5.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-537	In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.

Attack-Flow Graph

Executive Summary

This vulnerability in MiniDVBLinux 5.4 allows unauthenticated attackers to execute arbitrary commands as root by exploiting the 'command' GET parameter on the /tpl/commands.sh endpoint. This means attackers can send malicious commands remotely and gain full root-level access to the system.

Impact Analysis

The vulnerability can lead to complete system compromise since attackers can execute any command as root without authentication. This can result in unauthorized access, data theft, system manipulation, or disruption of services.

Hi! I’m here to help you understand CVE-2022-50691. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70