Auth bypass in Zoneminder
CVE-2023-26035
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.
Vulnerability class: Broken Access Control
EPSS: 0.805 (99.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Zoneminder — versions < 1.36.33, >= 1.37.0, < 1.37.33
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security-advisories@github.com
Frequently asked questions
- What is CVE-2023-26035?
- CVE-2023-26035 is a high-severity vulnerability in Zoneminder, classified under Missing Authorization. CVSS score: 7.2/10. Published 2023-02-25.
- How severe is CVE-2023-26035?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2023-26035 known to be exploited?
- 13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.