CVE-2025-25214
Published: 24 July 2025
Summary
CVE-2025-25214 is a high-severity Race Condition (CWE-362) vulnerability in Wwbn Avideo. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the race condition vulnerability in aVideoEncoder.json.php by applying patches to prevent arbitrary code execution.
Vulnerability monitoring and scanning identifies the presence of CVE-2025-25214 in AVideo installations, enabling timely patching.
Information input validation checks specially crafted HTTP requests to the unzip functionality, mitigating exploitation of the race condition.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Race condition in web app unzip handler directly enables remote arbitrary code execution over HTTP by an authenticated user, matching exploitation of a public-facing application.
NVD Description
A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of specially crafted HTTP request can lead to arbitrary code execution.
Deeper analysisAI
CVE-2025-25214 is a race condition vulnerability (CWE-362) in the unzip functionality of the aVideoEncoder.json.php component within WWBN AVideo version 14.4 and dev master commit 8a8954ff. Published on 2025-07-24, it enables arbitrary code execution through a series of specially crafted HTTP requests. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility and potential for significant impact.
An attacker with low privileges, such as an authenticated user (PR:L) possessing network access to the affected AVideo instance, can exploit this vulnerability. The attack requires low complexity and no user interaction, involving a sequence of HTTP requests that trigger the race condition during unzip operations. Successful exploitation grants arbitrary code execution, compromising confidentiality, integrity, and availability to a high degree.
Security practitioners should consult the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2212 for detailed mitigation guidance and patch information.
Details
- CWE(s)