RCE in World Wide Broadcast Network Avideo
CVE-2025-34433
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.014 (69.4th percentile) — read the EPSS interpretation.
Affected products
- World Wide Broadcast Network Avideo — versions 14.3.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (release-notes, patch)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (technical-description, exploit)
Frequently asked questions
- What is CVE-2025-34433?
- CVE-2025-34433 is a vulnerability in World Wide Broadcast Network Avideo, classified under Code Injection. Published 2025-12-19.
- Is CVE-2025-34433 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.