An unauthenticated remote denial of service vulnerability in WWBN AVideo allows attackers to exhaust system disk space, potentially crashing the host server.

The vulnerability exists in the aVideoEncoderChunk.json.php endpoint, which lacks authentication, resource limits, and cleanup mechanisms. An unauthenticated attacker can submit arbitrary POST requests that write persistent files to the server, resulting in total disk exhaustion.

The exploitation of this vulnerability directly impacts system availability, which may lead to significant operational disruption for organizations relying on the AVideo platform. With a CVSS score of 7.5, the risk is high because the attack vector is network-based and requires no authentication, making it trivial to execute against exposed instances.

Immediate Action: Since no official patch version is currently available, restrict access to the aVideoEncoderChunk.json.php endpoint at the web server level to prevent unauthorized requests.

Proactive Monitoring: Monitor server storage utilization and disk I/O metrics for sudden, unexpected spikes that may indicate an ongoing denial of service attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or rate-limit requests to the vulnerable PHP endpoint until a permanent vendor fix is applied.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for complete system denial of service, administrators must prioritize restricting access to the vulnerable endpoint immediately. Organizations should implement network-level controls as a temporary measure until the vendor releases a formal update that addresses the resource management flaw.