← Advisories

MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP (svdrpsend.sh) Exploit

Critical
Advisory ID
ZSL-2022-5714
Release Date
16 October 2022
Vendor
Affected Version
<=5.4
CVE
N/A
Tested On
MiniDVBLinux 5.4, BusyBox v1.25.1, Architecture: armhf, armhf-rpi2, GNU/Linux 4.19.127.203 (armv7l), VideoDiskRecorder 2.4.6
Summary

MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple way to convert a standard PC into a Multi Media Centre based on the Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this Linux based Digital Video Recorder: Watch TV, Timer controlled recordings, Time Shift, DVD and MP3 Replay, Setup and configuration via browser, and a lot more. MLD strives to be as small as possible, modular, simple. It supports numerous hardware platforms, like classic desktops in 32/64bit and also various low power ARM systems.

Description

The application allows the usage of the SVDRP protocol/commands to be sent by a remote attacker to manipulate and/or control remotely the TV.

Proof of Concept
Disclosure Timeline
24.09.2022Vulnerability discovered.
27.09.2022Vendor contacted.
15.10.2022No response from the vendor.
16.10.2022Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
16.10.2022Initial release
04.12.2022Added reference [1] and [2]
10.04.2023Added reference [3]