An improper access control vulnerability in the Serviio PRO Configuration REST API allows unauthenticated attackers to reset the mediabrowser login password, potentially leading to unauthorized access.

This is a missing authentication for a critical function (CWE-306) vulnerability. An unauthenticated remote attacker can send a crafted PUT request to the REST API endpoint to change administrative credentials.

Successful exploitation allows an attacker to gain unauthorized access to the Serviio media browser interface. By changing the password, the attacker can hijack administrative control, potentially exposing sensitive media library configurations or facilitating further unauthorized interactions with the media streaming server. Given the CVSS score of 7.5, this represents a high-severity risk that could lead to significant data exposure and loss of system integrity.

Immediate Action: There is no official patch currently documented for this specific legacy vulnerability. Administrators should restrict access to the Configuration REST API (typically port 23423) to trusted internal networks only.

Proactive Monitoring: Review web server and REST API access logs for suspicious PUT requests directed at the /rest/remote-access endpoint, especially from untrusted or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network access control list to block unauthorized access to the Serviio management ports. Ensure the media server is not exposed to the public internet.

Public Exploit Available: Yes, a public proof of concept script is available via ExploitDB (EDB-ID: 41960).

Given the availability of a functional exploit script and the lack of a verified vendor patch, the primary defense is strict network segmentation. Administrators must ensure that the Serviio Configuration REST API is not accessible from the public internet. If remote management is required, it should only be performed over a secure, authenticated VPN tunnel to mitigate the risk of unauthorized credential manipulation.