CVE-2025-34101

Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter

State: Published
Severity: 9.3 Critical
Published: Jul 10, 2025
Updated: May 14, 2026
Reserved: Apr 15, 2025

Description

An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console component (default port 23423). The checkStreamUrl method accepts a VIDEO parameter that is passed unsanitized to a call to cmd.exe, enabling arbitrary command execution under the privileges of the web server. No authentication is required to exploit this issue, as the REST API is exposed by default and lacks access controls.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306 Missing Authentication for Critical Function
CWE-20 Improper Input Validation

Affected Products

Product	Versions
Media ServerServiio	1.4 through 1.8Affected

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.phpthird-party-advisoryexploit
https://packetstorm.news/files/id/142387exploit
https://fortiguard.fortinet.com/encyclopedia/ips/44042third-party-advisory
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/serviio_checkstreamurl_cmd_exec.rbexploit
https://vulncheck.com/advisories/serviio-media-server-unauthenticated-command-injectionthird-party-advisory
https://www.exploit-db.com/exploits/42023exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.