VITEC vulnerabilities

Products

• exterity avediaserver 2
• Flamingo 2
• avediastream m9305 firmware 1
• avediastream m9325 firmware 1
• avediastream m9400 firmware 1
• avediastream m9405 firmware 1
• avediastream m9605 firmware 1
• avediastream r9300 firmware 1
• avediastream r9310 firmware 1
• avediastream r9350 firmware 1
• exterity avediastream encoders firmware 1

Latest VITEC CVEs

Newest publication first

1. CVE-2026-61498 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php

   Published 2026-07-13

   Critical·CVSS 9.3 EPSS 4.0%

   Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET p...

2. CVE-2026-60121 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php

   Published 2026-07-13

   Critical·CVSS 9.3 EPSS 3.3%

   Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshella...

3. CVE-2024-35102 Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script.

   Published 2024-05-15

   High·CVSS 8.8 EPSS 0.52%

   Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script.

4. CVE-2021-42109 VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.

   Published 2021-10-08

   Critical·CVSS 9.8 EPSS 1.7%

   VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.