Skip to content
Threat Feed
Subscribe

Vendor

MotionEye Project

1 brief RSS
critical advisory

motionEye: LFI → Pass-the-Hash Admin → Unsafe Restore → Unauthenticated Action Execution (RCE)

An attacker can chain multiple vulnerabilities in motionEye, including an arbitrary file read (LFI), a signature bypass using password hashes, and an unsafe configuration restore, to achieve unauthenticated remote code execution (RCE) if the normal user password is unset, or authenticated RCE from a normal user account.

motionEye RCE LFI vulnerability unauthenticated privilege-escalation
1r 5t