CVE-2024-58286: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in vexorian dizqueTV
dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by exploiting improper input validation.
AI Analysis
Technical Summary
CVE-2024-58286 is an OS command injection vulnerability in vexorian's dizqueTV version 1.5.3. It arises from improper neutralization of special elements in the FFMPEG Executable Path settings, allowing remote attackers to inject arbitrary shell commands without authentication. This can lead to remote code execution, including reading sensitive system files like /etc/passwd. The vulnerability has a CVSS 4.0 score of 9.3, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system without authentication. This can lead to unauthorized disclosure of sensitive information, system compromise, and potential full control over the host running dizqueTV 1.5.3. The high CVSS score (9.3) indicates critical severity with significant impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict network access to the dizqueTV management interface and avoid exposing the FFMPEG Executable Path settings to untrusted users. Consider deploying application-level controls or input validation proxies to mitigate injection risks.
CVE-2024-58286: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in vexorian dizqueTV
Description
dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by exploiting improper input validation.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-58286 is an OS command injection vulnerability in vexorian's dizqueTV version 1.5.3. It arises from improper neutralization of special elements in the FFMPEG Executable Path settings, allowing remote attackers to inject arbitrary shell commands without authentication. This can lead to remote code execution, including reading sensitive system files like /etc/passwd. The vulnerability has a CVSS 4.0 score of 9.3, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system without authentication. This can lead to unauthorized disclosure of sensitive information, system compromise, and potential full control over the host running dizqueTV 1.5.3. The high CVSS score (9.3) indicates critical severity with significant impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict network access to the dizqueTV management interface and avoid exposing the FFMPEG Executable Path settings to untrusted users. Consider deploying application-level controls or input validation proxies to mitigate injection risks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-12-10T23:46:14.008Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 693b3a6c22246175c6a3cf17
Added to database: 12/11/2025, 9:41:00 PM
Last enriched: 4/7/2026, 10:54:03 PM
Last updated: 5/8/2026, 9:18:33 AM
Views: 155
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.