World Wide Broadcast Network AVideo up to 20.0 API Endpoint uniqid code injection

Summaryinfo

A vulnerability was found in World Wide Broadcast Network AVideo up to 20.0. It has been classified as critical. The affected element is the function uniqid of the component API Endpoint. Performing a manipulation results in code injection. This vulnerability is cataloged as CVE-2025-34433. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in World Wide Broadcast Network AVideo up to 20.0. This affects the function uniqid of the component API Endpoint. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.

The weakness was shared by Valentin Lobstein. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-34433 since 04/15/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Upgrading to version 20.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-204542). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• World Wide Broadcast Network

Name

• AVideo

Version

• 20.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion