An unauthenticated command injection flaw in Serviio Media Server allows an attacker to send specially crafted HTTP requests to the /rest/action endpoint. The VIDEO parameter is passed unsanitized to cmd.exe, enabling arbitrary command execution under the privileges of the web server process. This yields full control over the server, compromising confidentiality, integrity and availability.

Serviio Media Server versions 1.4 through 1.8 running on Windows are affected. The vulnerability is exposed on the default REST API port 23423 and does not require authentication because the console component lacks access controls.

The CVSS score of 9.3 indicates a severe risk, and the EPSS score of 69% reflects a high likelihood of exploitation. While not listed in CISA KEV, the lack of authentication and the prevalence of the exposed API mean attackers can remotely access the vulnerability by sending HTTP requests from any network location that can reach port 23423. The exploit path is straightforward: craft a VIDEO parameter containing malicious commands and submit via the REST API, resulting in code execution with web‑server privileges.