A code injection vulnerability exists in an unspecified function of the Websocket API in AV Stumpfl Pixera Two Media Server up to version 25.2 R2. This vulnerability can be exploited remotely without authentication or user interaction, as indicated by the CVSS vector. The vulnerability has a CVSS 4.0 base score of 6.9, reflecting medium severity. Exploit code is publicly available. The vendor advises upgrading to version 25.2 R3 to remediate the issue.

Successful exploitation of this vulnerability allows remote attackers to inject code via the Websocket API, which may lead to unauthorized code execution or manipulation within the affected media server. This could compromise the integrity and availability of the system. The CVSS score of 6.9 indicates a medium impact level with low complexity and no required privileges or user interaction.

Upgrading the AV Stumpfl Pixera Two Media Server to version 25.2 R3 is recommended to address this vulnerability. Since the vendor advisory indicates upgrading as the remediation, applying this official fix is the primary mitigation. Patch status is not explicitly confirmed in the advisory, but the vendor's recommendation to upgrade implies a fix is available in 25.2 R3. Users should follow vendor guidance to update promptly.