CVE-2025-47782 HIGH

CVE-2025-47782: motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

Vendor Motioneye-Project
Product motioneye
Weakness CWE-78
Published May 14, 2025
Last update May 14, 2025
View on NVD All CVEs

CVSS base score

8.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.

Key dates

02Disclosure timeline

May 14, 2025 CVE published
May 14, 2025 Record updated