CVE-2026-30971High· 8.8▾ MidnightPoC availableZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
zoneminder < 1.36.40zoneminder >= 1.38.0, < 1.38.2zoneminder >= 1.39.0, < 1.39.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102607High· 8.8ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
CVE-2026-102608Critical· 9.0ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
CVE-2026-104198Medium· 5.3ZoneMinder failed token handling bypasses web authentication
CVE-2026-102297Medium· 4.3ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint
CVE-2026-102296Medium· 6.5ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers.…
CVE-2026-54258Medium· 6.5ZoneMinder is a free, open source closed-circuit television software application