External risk intelligence

dizqueTV RCE via FFMPEG Path Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2024-58286

dizqueTV is a media server application typically deployed in home or private network environments to stream content. While it may be exposed to the internet if a user manually forwards ports for remote access, it is not designed to be a public-facing edge service or gateway.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

dizqueTV, a media server application, has a critical vulnerability that could allow attackers to inject commands and potentially access system files. This issue stems from how the software handles executable path settings, specifically related to FFMPEG.

Attackers can inject commands via FFMPEG settings.
Matters if you use dizqueTV for media streaming.
Confirm relevance and assess exposure to dizqueTV.

Attack Path

How an attacker could exploit the issue

Attackers can exploit a vulnerability in dizqueTV by manipulating the FFMPEG Executable Path setting to inject arbitrary commands. This allows them to execute commands with the privileges of the dizqueTV process, potentially leading to unauthorized access to system files and further compromise.

No authentication or user interaction needed.
Attacker modifies FFMPEG path with commands.
Arbitrary command execution, file access.

Live Threat

Current exploitation, exposure, and threat context

Attackers could gain unauthorized access to system files on a dizqueTV server by manipulating the FFMPEG Executable Path setting. This could occur when the FFMPEG Executable Path setting is not properly validated, allowing for the injection of malicious commands. This could potentially expose sensitive system information.

System file data may be exposed.
Input validation flaws may allow command injection.
Unauthorized access to system files.

Operational Fix

Recommended remediation, mitigation, and detection steps

The dizqueTV application, specifically version 1.5.3, presents a critical remote code execution vulnerability stemming from improper input validation in its FFMPEG executable path settings. This allows unauthenticated attackers to inject arbitrary commands, potentially leading to unauthorized access to sensitive system files. Owners of dizqueTV instances must first identify all deployments, assess their internet exposure and business criticality, and then determine the accountable team for remediation planning.

Application owners must take ownership.
Verify FFMPEG executable path configurations.
Plan remediation based on exposure risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is dizqueTV?

dizqueTV is a media server application used to create live-style television channels from local video collections. It typically runs on home or private networks, functioning as a streaming tool that processes media files using FFMPEG to generate the broadcast signal.

What is the vulnerability in CVE-2024-58286?

This CVE involves a weakness classified as CWE-78, or OS Command Injection. The software fails to properly validate input provided in the FFMPEG Executable Path settings. Because this path is used to launch system processes, an attacker can insert their own shell commands to be executed by the server.

How can an attacker trigger this command injection?

An attacker triggers this by modifying the FFMPEG Executable Path configuration field to include malicious shell commands. It does not require authentication or user interaction to succeed. Simply navigating the application settings normally or performing routine administrative tasks does not trigger this; the exploit specifically requires the deliberate entry of injected command strings into that configuration field.

Why should I care if my dizqueTV instance is internet-facing?

According to Halo Surface Signal, dizqueTV is designed for private use and is not meant to be a public-facing edge service. If your instance is exposed to the internet, such as through manually configured port forwarding, the barrier to access for an unauthorized attacker is significantly lowered, making your system susceptible to this remote code execution vulnerability.

How do I respond if I am running dizqueTV?

First, conduct an inventory to locate all active dizqueTV deployments within your environment. Verify the current configuration of your FFMPEG executable path settings. Assess the business risk of these instances, particularly if they are reachable from the internet, and coordinate with your technical team to prioritize remediation planning for any identified instances.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.