CVE-2024-58286

dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by exploiting improper input validation.

CVSS

No CVSS.

References

Link	Resource
https://github.com/vexorian/dizquetv
https://www.exploit-db.com/exploits/52079
https://www.vulncheck.com/advisories/dizquetv-remote-code-execution-via-ffmpeg-executable-path

Configurations

No configuration.

History

02 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) dizqueTV 1.5.3 contiene una vulnerabilidad de ejecución remota de código que permite a los atacantes inyectar comandos arbitrarios a través de la configuración de la Ruta del Ejecutable FFMPEG. Los atacantes pueden modificar la ruta del ejecutable con comandos de shell para leer archivos del sistema como /etc/p4ssd explotando una validación de entrada inadecuada.

Information

Published : 2025-12-11 22:15

Updated : 2026-10-02 00:10

NVD link : CVE-2024-58286

Mitre link : CVE-2024-58286

CVE.ORG link : CVE-2024-58286

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2024-58286", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58286", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T16:15:58.418822Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "vexorian", "product": "dizqueTV", "versions": [{"status": "affected", "version": "1.5.3"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-11T22:15:48.203", "references": [{"url": "https://github.com/vexorian/dizquetv", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/52079", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dizquetv-remote-code-execution-via-ffmpeg-executable-path", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by exploiting improper input validation."}, {"lang": "es", "value": "dizqueTV 1.5.3 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo que permite a los atacantes inyectar comandos arbitrarios a trav\u00e9s de la configuraci\u00f3n de la Ruta del Ejecutable FFMPEG. Los atacantes pueden modificar la ruta del ejecutable con comandos de shell para leer archivos del sistema como /etc/p4ssd explotando una validaci\u00f3n de entrada inadecuada."}], "lastModified": "2026-10-02T00:10:00.180", "sourceIdentifier": "disclosure@vulncheck.com"}