CVE-2023-26035 HIGH

CVE-2023-26035: ZoneMinder vulnerable to Missing Authorization

Vendor Zoneminder
Product zoneminder
Weakness CWE-862 · Missing authorization
Published February 25, 2023
Last update February 13, 2025
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.

Key dates

02Disclosure timeline

February 25, 2023 CVE published
February 13, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-47361 WordPress Elementor Addon Elements plugin <= 1.13.6 - Broken Access Control vulnerability CVE-2023-47874 WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Broken Access Control CVE-2024-44115 Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform CVE-2025-28994 WordPress Viral Loops WP Integration plugin <= 3.8.1 - Broken Access Control Vulnerability CVE-2024-3897 Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure