CVE-2025-34433 json
AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
published 2025-12-19 10 mo ago modified 2026-06-23 4 mo ago also EUVD-2025-204542
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 1
- Metasploit
Summary
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.
Patch / fix
- World Wide Broadcast Network AVideo 20.1
- github.com/WWBN/AVideo@4a53ab2 commit
- github.com/WWBN/AVideo@a2bdbff commit
Timeline
- First public exploit (Metasploit exploit/multi/http/avideo_notify_ffmpeg_unauth_rce)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction
1.48% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/avideo_notify_ffmpeg_unauth_rce AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery metasploit exploit, excellent rank, 2025-12-19
- chocapikk.com https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- World Wide Broadcast Network AVideo
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/WWBN/AVideo/commit/4a53ab2
patch
-
github.com
/WWBN/AVideo/commit/a2bdbff
patch
-
chocapikk.com
/posts/2025/avideo-security-vulnerabilities/
technical-description, exploit
-
vulncheck.com
/advisories/avideo-unauthenticated-rce-via-predictable-installation-salt
third-party-advisory
Sources
- CVE List CVE-2025-34433
- NVD CVE-2025-34433
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.