CVE-2023-53774 is a critical flaw (CVSS 9.8) in MiniDVBLinux 5.4. The Simple Video Disk Recorder Protocol, SVDRP, accepts commands from remote attackers without authentication, letting them control the recorder. No fixed version is confirmed, so restrict network access to the device.
What's affected
The CVE record lists MiniDVBLinux 5.4, and VulnCheck lists 5.4 and earlier. The description says remote attackers can send crafted SVDRP commands, for example through the svdrpsend.sh script, to run messages and potentially control the video disk recorder remotely. The record links a public exploit listing and the Zero Science Lab advisory ZSL-2022-5714.
SVDRP is a documented control protocol of the Video Disk Recorder project. The wiki entry linked in the record lists its commands. I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release.
How to check if you're exposed
Find out whether the SVDRP service is listening on the device. A network scan from another machine on the same network will show whether the SVDRP port answers. If it does, anyone on that network can talk to it.
Then check what the device is reachable from. A recorder on an isolated network behind a router is a smaller problem than one forwarded to the internet.
Check the device's version in the web interface, and compare it with 5.4.
What to do now
- Find MiniDVBLinux devices and note which expose the SVDRP service.
- Block the SVDRP port at the network level, so only the devices that need it can reach it.
- Remove internet exposure and port forwards.
- Look for a newer release on the project site and apply it if one exists.
- Treat the device as untrusted if it was reachable, and review its configuration and recordings.
Why it matters
Again the class is missing authentication for a critical function (CWE-306). SVDRP was designed for use on a trusted local network, where a user or a script sends control commands to a recorder. When such a protocol is reachable by anyone and has no login, the device accepts orders from whoever sends them.
The record titles the issue remote code execution, but the described effect is controlling the recorder through its own command set, and the NVD score is 9.8. VulnCheck scores the same issue lower, at 6.9 on the newer CVSS version, because its vector has limited impact on integrity and availability. The two scores reflect a real disagreement about how far the control goes, so measure the risk by what the device holds and what else it can reach. The CVE is not on the CISA Known Exploited Vulnerabilities list. The sibling issue is CVE-2023-53771.
Quick check
Is this the same as the password reset issue?
No. It is a separate flaw in the SVDRP protocol on the same product. Fixing one does not fix the other.
What is the quickest mitigation?
Block the SVDRP port from anything that does not need it, and keep the device off the internet.
Sources
Last reviewed: 19 October 2026.
