CVE-2023-53771 is a critical authentication flaw (CVSS 9.8) in MiniDVBLinux 5.4, a Linux distribution for digital video recorders. A remote attacker can change the root password through the system setup endpoint without logging in. No fixed version is confirmed, so keep devices off untrusted networks.
What's affected
The CVE record lists MiniDVBLinux 5.4, and VulnCheck lists MiniDVBLinux 5.4 and earlier. The description says attackers can send crafted POST requests to the system setup endpoint to reset root credentials. The record links a public exploit listing and the Zero Science Lab advisory ZSL-2022-5715.
I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release.
How to check if you're exposed
On the device, find the distribution version in the web interface or in the release file. Version 5.4 is the one the record names, and VulnCheck treats 5.4 and earlier as affected.
Then test who can reach the web interface. A set top box or recorder on a home or small office network is usually reachable by everything on that network. If the device is forwarded to the internet, it is reachable by anyone.
Check whether you can still sign in with the root password you set. A changed password is a sign that someone else has used the endpoint.
What to do now
- Find MiniDVBLinux devices on your networks.
- Take them off the internet, and remove any port forwarding rules that point to them.
- Put them on a separate network segment or VLAN that other devices cannot browse.
- Check the project site for a newer release and apply it if there is one.
- Confirm that the root password still works, and change it if you have any doubt.
- If the device is not worth maintaining, retire it.
Why it matters
The class is missing authentication for a critical function (CWE-306). Changing the root password is the most sensitive action on a Linux box. The setup page performs it for any caller, so the usual protection of knowing a login does not apply. Root control means the attacker owns the device, can read recordings and configuration, and can use it as a foothold on the local network.
The product is a niche distribution, which means few organisations run it, but those that do often forget about it. The record does not describe attacks in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list. The sibling issue CVE-2023-53774 covers the SVDRP protocol on the same product.
Quick check
Do I need a login to exploit this?
No. The record describes a remote attacker without authentication.
Is a patch available?
I could not confirm one. Check the project site, and limit network access in the meantime.
Sources
Last reviewed: 19 October 2026.
