CVE-2023-26039CWE-78

ZoneMinder vulnerable to OS Command injection in daemonControl() API

High · published February 25, 2023

CVSS v3.1
7.1
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01257 · 69.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-02-25T01:31Z
EPSS history
Timeline
  • 25 FEB 01:31Z
    ZoneMinder vulnerable to OS Command injection in daemonControl() API
    cvelistv5