« Back to list

CVE-2023-26035

Status: ModifiedCritical (9.8)—💥 Exploit

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (1)

Zoneminder — Zoneminder

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2023-26035",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "ZoneMinder",
          "product": "zoneminder",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.36.33"
            },
            {
              "status": "affected",
              "version": ">= 1.37.0, < 1.37.33"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-02-25T02:15:13.550",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/175675/ZoneMinder-Snapshots-Command-Injection.html",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-72rg-h4vf-29gr",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/175675/ZoneMinder-Snapshots-Command-Injection.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-72rg-h4vf-29gr",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33."
    },
    {
      "lang": "es",
      "value": "ZoneMinder es una aplicación de software de circuito cerrado de televisión de código abierto y gratuita para Linux que admite cámaras IP, USB y analógicas. Las versiones anteriores a 1.36.33 y 1.37.33 son vulnerables a la ejecución remota de código no autenticado mediante autorización faltante. No hay verificación de permisos en la acción de instantánea, que espera que una identificación busque un monitor existente, pero en su lugar se le puede pasar un objeto para crear uno nuevo. TriggerOn termina llamando a shell_exec usando la identificación proporcionada. Este problema se solucionó en Este problema se solucionó en las versiones 1.36.33 y 1.37.33."
    }
  ],
  "lastModified": "2026-06-17T05:42:30.997",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4A5EDFC-FCEB-4982-A3D1-C95814646A27",
              "versionEndExcluding": "1.36.33"
            },
            {
              "criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1AF3896-BC5B-4FB6-842D-29B621F987E4",
              "versionEndExcluding": "1.37.33",
              "versionStartIncluding": "1.37.00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}