MiniDVBLinux up to 5.4 GET Parameter /tpl/commands.sh command java runtime error message containing sensitive information

Summaryinfo

A vulnerability classified as very critical has been found in MiniDVBLinux up to 5.4. The impacted element is an unknown function of the file /tpl/commands.sh of the component GET Parameter Handler. Performing a manipulation of the argument command results in java runtime error message containing sensitive information. This vulnerability was named CVE-2022-50691. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as very critical has been found in MiniDVBLinux up to 5.4. This affects some unknown processing of the file /tpl/commands.sh of the component GET Parameter Handler. The manipulation of the argument command with an unknown input leads to a java runtime error message containing sensitive information vulnerability. CWE is classifying the issue as CWE-537. In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.

The weakness was presented by Gjoko Krstic as 168749. The advisory is shared at zeroscience.mk. This vulnerability is uniquely identified as CVE-2022-50691 since 12/21/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/31/2025). MITRE ATT&CK project uses the attack technique T1592 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• MiniDVBLinux

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion