CVE-2023-53774
Published: 09 December 2025
Description
MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems. Attackers can send crafted SVDRP commands through the svdrpsend.sh script to execute messages and potentially control the…
more
video disk recorder remotely.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of known flaws like this RCE vulnerability in the SVDRP protocol implementation.
Prevents remote exploitation by monitoring and controlling communications at external boundaries to block access to the vulnerable unauthenticated SVDRP service.
Mandates unique identification and authentication for non-organizational users or processes, addressing the missing authentication (CWE-306) that enables crafted SVDRP commands to achieve RCE.
Security SummaryAI
MiniDVBLinux 5.4, a Linux distribution for video disk recorders, contains a remote code execution vulnerability identified as CVE-2023-53774 in its implementation of the SVDRP protocol. This flaw, classified under CWE-306 (Missing Authentication for Critical Function), allows remote attackers to send crafted SVDRP commands through the svdrpsend.sh script. These commands can execute arbitrary messages, enabling manipulation and remote control of the TV system and video disk recorder.
The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges or user interaction required. Any unauthenticated remote attacker who can reach the affected SVDRP service can send malicious commands to achieve full remote code execution, potentially compromising confidentiality, integrity, and availability of the system, including control over TV recording and playback functions.
Advisories from VulnCheck and Zero Science Laboratory (ZSL-2022-5714) describe the issue in detail, with a public proof-of-concept exploit available on Exploit-DB (51093). Additional resources include the MiniDVBLinux website and the LinuxTV VDR Wiki on SVDRP commands. No specific patch details are outlined in the provided references, but practitioners should consult these for mitigation guidance.
A public exploit confirms active interest, suggesting potential real-world exploitation risk for exposed MiniDVBLinux 5.4 deployments.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote code execution over the network via a public-facing SVDRP service, directly mapping to exploitation of public-facing applications.