CVE-2025-34433: AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Fixed in 20.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34433?
CVE-2025-34433 is a critical vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2025-34433?
To fix CVE-2025-34433, upgrade AVideo to version 20.1 or later to mitigate the vulnerability.
What causes CVE-2025-34433?
CVE-2025-34433 is caused by predictable generation of an installation salt using PHP uniqid(), leading to remote code execution.
What versions of AVideo are affected by CVE-2025-34433?
AVideo versions 14.3.1 up to, but not including, 20.1 are affected by CVE-2025-34433.
Is authentication required to exploit CVE-2025-34433?
No, CVE-2025-34433 can be exploited without authentication, making it particularly dangerous.