CVE-2023-26039: ZoneMinder vulnerable to OS Command injection in daemonControl() API
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-26039?
CVE-2023-26039 is a vulnerability in ZoneMinder, a free open source Closed-circuit television software application for Linux, which allows OS Command Injection via daemonControl() in HostController.php.
How does CVE-2023-26039 impact ZoneMinder?
CVE-2023-26039 allows any authenticated user to execute arbitrary OS commands through the daemonControl() function in HostController.php.
What is the severity of CVE-2023-26039?
CVE-2023-26039 has a severity rating of 8.8 out of 10 (high severity).
How can I fix CVE-2023-26039 vulnerability?
To fix CVE-2023-26039 vulnerability, it is recommended to update ZoneMinder to version 1.37.33 or higher.
Where can I find more information about CVE-2023-26039?
You can find more information about CVE-2023-26039 on the official GitHub security advisory page: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-44q8-h2pw-cc9g.