CVE-2025-47782

HIGH EPSS 32.5%
Published May 14, 20251y ago · Modified Jun 17, 20262w ago
8.9 CVSS 4.0
High
Find Similar
Published May 14, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.

CVSS Details

Base Score
8.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
32.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

References 3

  • github.com https://github.com/motioneye-project/motioneye/issues/3142
  • github.com https://github.com/motioneye-project/motioneye/pull/3143
  • github.com https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.