Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck
CVE-2024-58286dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path
Critical 9.3
In plain English
A critical-severity OS command injection in dizqueTV from vexorian. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)1.4%top 27.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Metasploit
Official description
dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by exploiting improper input validation.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- ExploitDB-52079 exploit
- DizqueTV GitHub Repository product
- VulnCheck Advisory: dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path third-party-advisory