Vulnerability in N/a
CVE-2022-29806
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.
EPSS: 0.707 (98.7th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- forums.zoneminder.com/viewtopic.php (x_refsource_MISC)
- github.com/ZoneMinder/zoneminder/releases/tag/1.36.13 (x_refsource_MISC)
- github.com/ZoneMinder/zoneminder/commit/9fee64b62fbdff5bf5ece1d617f1f53c7b1967cb (x_refsource_MISC)
- krastanoel.com/cve/2022-29806 (x_refsource_MISC)
- packetstormsecurity.com/files/166980/ZoneMinder-Language-Settings-Remote-Code-E… (x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-29806?
- CVE-2022-29806 is a vulnerability in N/a. Published 2022-04-26.
- Is CVE-2022-29806 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.