Cyber Resilience

CVE-2023-25313

CriticalPublic PoCRCE

Published: 25 April 2023

Published
25 April 2023
Modified
03 February 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0943 93.0th percentile
Risk Priority 25 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-25313 is a critical-severity OS Command Injection (CWE-78) vulnerability in Wwbn Avideo. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2023-25313 is an OS command injection vulnerability, tracked as CWE-78, that affects World Wide Broadcast Network AVideo versions before 12.4. The flaw is present in the Embed a video link feature and can be triggered through the video link input field, enabling remote code execution.

An unauthenticated attacker with network access can supply a malicious video link to execute arbitrary operating-system commands on the server. The vulnerability carries a CVSS 3.1 score of 9.8, reflecting that no user interaction or credentials are required and that successful exploitation can impact confidentiality, integrity, and availability.

The issue is documented in the GitHub Security Advisory GHSA-pgvh-p3g4-86jw, which provides the authoritative reference for remediation steps and any released patches. The current EPSS score stands at 0.0943 with an identical recorded peak, indicating no material post-disclosure increase in observed exploitation activity.

EU & UK References

Vulnerability details

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

wwbn
avideo
≤ 12.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References