An OS command injection flaw in MiniDVBLinux allows a remote, unauthenticated attacker to supply unsanitized input that is passed directly to the system shell. Because the web‑based management interface executes commands with root privileges, the vulnerability gives full control over the device, including modifying configurations, installing backdoors, or disabling services. The weakness corresponds to CWE‑78 and can lead to complete compromise of the target.

MiniDVBLinux devices running version 5.4 or earlier are affected. The vulnerability exists in the publicly accessible web management interface of all affected installations, regardless of network placement. No specific vendor folder other than MiniDVBLinux.

The flaw carries a CVSS score of 9.3 and an EPSS of 29 %, indicating both high severity and a relatively high likelihood of exploitation. The attack can be carried out from any network connected to the management interface without authentication, enabling the execution of arbitrary commands as root. Because the vulnerability is already public and has been used in the wild, the risk is immediate and significant; the addition of the 29 % EPSS score further emphasizes that exploitation is expected to occur soon.