CVE-2025-47782highCWE-78

CVE-2025-47782: falha de alta gravidade em motioneye-project motioneye

motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

Publicada em

Seguir esta CVE+ Monitorar motioneye+ Monitorar motioneye

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.9epss 0.5%
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
motioneye-project · motioneye
CVEs relacionadas — motioneye-project motioneye

No mesmo produto, das mais perigosas para as menos.

CVE-2026-32315MEDIUMmotionEye: World-Readable Configuration File Exposes Admin Password HashEPSS 1.7%CVE-2026-55488HIGHmotionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File ReadEPSS 0.6%CVE-2026-55863MEDIUMmotionEye: Missing authentication on ActionHandler allows unauthenticated camera action executionEPSS 0.5%CVE-2026-46488CRITICALmotionEye: Authentication possible via password hashEPSS 0.5%CVE-2026-31978MEDIUMmotionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview EndpointEPSS 0.3%