CVE-2023-53771
MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 9, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 8, 2025
Description
MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can send crafted POST requests to the system setup endpoint with modified SYSTEM_PASSWORD parameters to reset root credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
MiniDVBLinux Change Root Password PoCMiniDVBLinux |
|
References
- ExploitDB-51094exploit
- Zero Science Lab Disclosure (ZSL-2022-5715)third-party-advisory
- Official Product Homepageproduct
- VulnCheck Advisory: MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setupthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.