EUVD-2025-32486
GHSA-j945-qm58-4gjx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.
AnalysisAI
MotionEye video surveillance software version 0.43.1b4 and earlier contains an authenticated OS command injection via configuration parameters such as image_file_name. Admin users can inject commands that execute when the Motion daemon restarts, achieving code execution on the surveillance server.
Technical ContextAI
MotionEye writes user-supplied configuration values (like image_file_name) directly into Motion configuration files without sanitization. When Motion restarts, the configuration values are processed by the daemon. By injecting shell metacharacters into configuration fields, an admin user can execute arbitrary commands when Motion processes the configuration.
RemediationAI
Update MotionEye to a version with input sanitization. Change default credentials. Restrict MotionEye access to VPN or trusted networks. Run MotionEye as a non-root user. Monitor for unauthorized configuration changes.
Share
External POC / Exploit Code
Leaving vuln.today