Vulnerability · Published Dec 9, 2025 · Assigned by VulnCheck

CVE-2023-53770MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint

High 8.7

In plain English

A high-severity security flaw in MiniDVBLinux(TM) Distribution (MLD) from MiniDVBLinux. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GET request with 'action=getconfig' to retrieve a complete system configuration archive containing sensitive credentials.

Affected products (as reported)

Vendor	Product	Versions
MiniDVBLinux	MiniDVBLinux(TM) Distribution (MLD)	<=5.4

Weakness: CWE-260 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

ExploitDB-51091 exploit
Official Product Homepage product
Zero Science Lab Disclosure (ZSL-2022-5713) third-party-advisory
VulnCheck Advisory: MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint third-party-advisory