TI-2025-24503 Aliases CVE-2025-34433 GHSA-hv75-87h9-4p5h

AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt

MEDIUM 51CWE-94Published 2025-12-19 · Updated 2026-06-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0148 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed AVideo (World Wide Broadcast Network): 20.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WWBN	AVideo	14.3.1 to before 20.1	20.1	Patch available	CNA

AVideo VendorWWBN Affected 14.3.1 to before 20.1 Fixed in 20.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:wwbn:avideo::::::::	—	—	WWBN

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* Versions — — ·WWBN

Remediation

Fix · CNA AVideo (World Wide Broadcast Network) Fixed in 20.1

Timeline

2026-10-02 Threatist record created from CVE-2025-34433
2026-10-03 Alias added: GHSA-hv75-87h9-4p5h

References

Exploit 1

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/

Patch 2

TI-2026-82233 OS command injection in AVideo-Encoder via forged streamer login CVSS 3.1CRITICAL 10.0
TI-2026-82232 Unauthenticated PHP code injection in AVideo-Encoder installer CVSS 3.1CRITICAL 10.0
TI-2026-29567 Code injection in WWBN AVideo CVSS 3.1CRITICAL 10.0
TI-2026-26095 AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVSS 3.1CRITICAL 9.4
TI-2026-25874 Improper access control in WWBN AVideo CVSS 3.1CRITICAL 10.0
TI-2026-25758 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVSS 3.1CRITICAL 9.8

See all 364 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences