An OS command injection flaw in MiniDVBLinux allows a remote, unauthenticated attacker to supply unsanitized input that is passed directly to the system shell. The flaw results in execution of arbitrary commands with root privileges, enabling full compromise of the device, including configuration changes, backdoor installation, or service disruption.

MiniDVBLinux devices running version 5.4 or earlier are affected. The vulnerability resides in the publicly accessible web‑based management interface of all affected installations, regardless of network placement. No specific vendor folder other than MiniDVBLinux.

The flaw carries a CVSS score of 9.3 and an EPSS score of 5 %. Based on the description, it is inferred that an attacker can exploit the vulnerability from any network point that can reach the management interface without authentication. Because the vulnerability is already public and has been observed in the wild, the risk is significant, though the relatively low EPSS score indicates that exploitation may not be widespread. The issue is not listed in CISA’s KEV catalog.