CVE-2025-34433
Published: 19 December 2025
Summary
CVE-2025-34433 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 29.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
AVideo versions prior to 20.1 contain an unauthenticated remote code execution flaw stemming from predictable installation salt generation via PHP uniqid(). The installation timestamp is exposed through a public endpoint while a derived hash identifier is retrievable via unauthenticated API responses, enabling attackers to brute-force the remaining entropy and recover the salt.
An unauthenticated remote attacker can leverage the recovered salt to encrypt a malicious payload and submit it to the notification API endpoint, which evaluates attacker-controlled input and yields arbitrary code execution as the web server user. The vulnerability carries a CVSS 4.0 score of 9.3 and is tracked under CWE-94.
Public references, including the VulnCheck advisory and upstream commits, indicate the issue is resolved in version 20.1; administrators should upgrade AVideo and ensure the installation endpoint and API responses are no longer reachable without authentication.
EPSS for the CVE rose from lower values after disclosure to a peak of 0.5168 on 2026-04-20 before receding to the current 0.4108, indicating post-publication exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204542
Vulnerability details
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible…
more
through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.