CVE-2024-58286 json
dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path
published 2025-12-11 10 mo ago modified 2026-10-02 38 d ago also EUVD-2024-55324
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 1
- Metasploit
Summary
dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by exploiting improper input validation.
Timeline
- First public exploit (Metasploit exploit/multi/http/dizquetv_rce)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction
1.37% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/dizquetv_rce dizqueTV Unauthenticated Remote Code Execution metasploit exploit, excellent rank, 2024-09-21
- exploit-db.com https://www.exploit-db.com/exploits/52079 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- vexorian dizqueTV
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
exploit-db.com
/exploits/52079
exploit
-
github.com
/vexorian/dizquetv
product
-
vulncheck.com
/advisories/dizquetv-remote-code-execution-via-ffmpeg-executable-path
third-party-advisory
Sources
- CVE List CVE-2024-58286
- NVD CVE-2024-58286
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.