CVE-2025-34101
Published: 10 July 2025
Summary
CVE-2025-34101 is a critical-severity Improper Input Validation (CWE-20) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An unauthenticated command injection vulnerability affects Serviio Media Server versions 1.4 through 1.8 on Windows. The flaw resides in the console component's /rest/action API endpoint on the default port 23423, where the checkStreamUrl method accepts an unsanitized VIDEO parameter that is passed directly to cmd.exe, enabling arbitrary command execution under the web server's privileges. The issue is tracked under CWE-20, CWE-78, and CWE-306 and carries a CVSS 4.0 score of 9.3.
Remote attackers require no authentication to exploit the vulnerability because the REST API is exposed by default without access controls. Successful exploitation grants full control over the host, allowing arbitrary command execution that can lead to complete system compromise.
Public exploit code is available, including a Metasploit module and an Exploit-DB entry, and the EPSS score has reached 0.6885. The listed references point to detection signatures and proof-of-concept material but do not detail vendor patches or specific mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21036
Vulnerability details
An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console component (default port 23423). The checkStreamUrl method accepts a VIDEO parameter that is passed unsanitized…
more
to a call to cmd.exe, enabling arbitrary command execution under the privileges of the web server. No authentication is required to exploit this issue, as the REST API is exposed by default and lacks access controls.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Directly implements checks on information inputs to reject invalid data before processing.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.