SB2026110388 - OS command injection in ZoneMinder

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary OS commands as the ZoneMinder runtime user.

The vulnerability exists due to improper neutralization of OS commands and insufficient authorization in the ZoneMinder filter execution flow when processing temporary event filters. A remote attacker can use an Events=View account, or chain exploitation with a JWT/session authentication bypass or a default JWT secret, to submit a temporary filter with AutoExecute=1 and an attacker-controlled AutoExecuteCmd to execute arbitrary OS commands through zmfilter.pl.

The demonstrated exploit requires at least one existing event with Executed=0.

Remediation

Install update from vendor's website.

References

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wgcm-2239-xjqc
• https://github.com/ZoneMinder/zoneminder/commit/9a49c9b09