CVE-2025-47782
HIGHmotioneye 0.43.1b1-0.43.1b3 - Authenticated OS Command Injection via Camera Device Path
Title source: llmDescription
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588
Issue Tracking x_refsource_misc
https://github.com/motioneye-project/motioneye/issues/3142
Issue Tracking x_refsource_misc
https://github.com/motioneye-project/motioneye/pull/3143
Scores
CVSS v4
8.9
EPSS
0.0033
EPSS Percentile
56.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (2)
motioneye-project/motioneye
>= 0.43.1b1, < 0.43.1b4
pypi/motioneye
0.43.1b1 - 0.43.1b4PyPI
Published
May 14, 2025
Tracked Since
Feb 18, 2026