Executive brief
motionEye, a web-based interface for managing video surveillance cameras, is vulnerable to a security flaw that allows administrators to execute unauthorized commands on the underlying server. By providing specially crafted text in configuration settings like file names, an attacker with administrative access can take full control of the system when the service restarts. This could lead to the theft of video footage, surveillance disruption, or the use of the server as a foothold for further attacks on the network.
Technical details
An OS command injection vulnerability exists in motionEye versions up to and including 0.43.1b4 due to improper neutralization of special elements in configuration parameters. The application fails to sanitize user-supplied input for fields like 'image_file_name' before writing them to Motion configuration files. An attacker with administrative credentials can bypass client-side validation to inject shell commands. These commands are executed with the privileges of the motionEye process when the Motion service is subsequently restarted. As of the advisory date, no official patch is available, though workarounds involving strict access control for administrative accounts are recommended.
Affected products
- motionEye Project motionEye 0.43.1b4 and earlier
Timeline
- 2025-10-03: advisory: NVD published the CVE record
- 2025-10-03: disclosed: Public PoC released on GitHub