{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3azoneminderzoneminder/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9,"id":"CVE-2026-102608"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ZoneMinder (\u003c 1.38.3)"],"_cs_severities":["high"],"_cs_tags":["command-injection","vulnerability","remote-code-execution","surveillance"],"_cs_type":"advisory","_cs_vendors":["ZoneMinder"],"content_html":"\u003cp\u003eZoneMinder, an open-source closed-circuit television (CCTV) software, contains a critical OS command injection vulnerability tracked as CVE-2026-102608. The issue stems from the improper sanitization of the 'Monitor Name' field within the \u003ccode\u003edownload_functions.php\u003c/code\u003e script. Specifically, the application uses manual single-quote wrapping instead of robust functions like \u003ccode\u003eescapeshellarg()\u003c/code\u003e when constructing command-line arguments for system utilities including \u003ccode\u003effmpeg\u003c/code\u003e, \u003ccode\u003etar\u003c/code\u003e, and \u003ccode\u003ezip\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAn attacker possessing monitor-create or monitor-edit permissions can inject shell metacharacters into a monitor name. When a user with 'Events View' permissions triggers an event export for that monitor, the malicious input breaks out of the manual quoting, leading to arbitrary command execution in the context of the web server user. This vulnerability is fixed in version 1.38.3. Given the public availability of proof-of-concept exploit code, immediate patching is required for all instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to the ZoneMinder web interface with credentials possessing monitor-create or monitor-edit privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the monitor configuration and creates or renames a monitor, inserting shell metacharacters (e.g., \u003ccode\u003e;\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u0026amp;\u003c/code\u003e, \u003ccode\u003e$()\u003c/code\u003e) into the 'Monitor Name' field.\u003c/li\u003e\n\u003cli\u003eThe malicious monitor name is saved into the backend database.\u003c/li\u003e\n\u003cli\u003eAn authenticated user with 'Events View' permissions initiates an event export process for the compromised monitor.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edownload_functions.php\u003c/code\u003e script retrieves the monitor name from the database.\u003c/li\u003e\n\u003cli\u003eThe script improperly concatenates the name into shell commands for \u003ccode\u003effmpeg\u003c/code\u003e, \u003ccode\u003etar\u003c/code\u003e, or \u003ccode\u003ezip\u003c/code\u003e utilities.\u003c/li\u003e\n\u003cli\u003eThe system executes the injected commands as the web server user process (e.g., www-data).\u003c/li\u003e\n\u003cli\u003eFinal objective achieved: remote command execution, potential lateral movement, or system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full remote code execution on the underlying server as the web server user. This provides the attacker the ability to pivot deeper into the internal network, exfiltrate stored CCTV footage, or disrupt surveillance operations. This vulnerability is rated with a CVSS 9.0 (High) score, posing a significant risk to organizations relying on ZoneMinder for physical security monitoring.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade ZoneMinder to version 1.38.3 or later immediately to patch CVE-2026-102608.\u003c/li\u003e\n\u003cli\u003eAudit existing monitor names for the presence of shell metacharacters such as semicolon, pipe, or backticks using the web interface or direct database queries.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests to \u003ccode\u003edownload_functions.php\u003c/code\u003e that include excessive query parameters or shell metacharacters.\u003c/li\u003e\n\u003cli\u003eEnforce strict role-based access control (RBAC) to limit the number of users with monitor-create or monitor-edit permissions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T20:44:29Z","date_published":"2026-10-16T20:44:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zoneminder-rce/","summary":"An authenticated OS command injection vulnerability (CVE-2026-102608) in ZoneMinder versions prior to 1.38.3 allows remote code execution via unsanitized monitor names during event export operations.","title":"ZoneMinder Authenticated OS Command Injection via Monitor Name","url":"https://feed.craftedsignal.io/briefs/2026-10-zoneminder-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}