SB2026110389 - Multiple vulnerabilities in ZoneMinder
Published: November 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) OS Command Injection (CVE-ID: N/A)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary operating system commands as the web server user on the ZoneMinder server.
The vulnerability exists due to improper neutralization of shell metacharacters in the wget() helper in web/includes/monitor_probe.php when processing camera discovery URLs containing user-controlled credentials. A remote user can submit a camera username such as a;touch /tmp/zm_probe_marker;# through the camera discovery request to inject shell commands into the URL passed to exec() and execute arbitrary commands as the web server user.
Exploitation requires Monitors Create or Edit permissions and a deployment where camera discovery reaches a wget()-based vendor helper, such as Hikvision, Avigilon, or Vivotek.
2) OS Command Injection (CVE-ID: N/A)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary operating system commands as the web server user on the ZoneMinder server.
The vulnerability exists due to improper neutralization of shell metacharacters in the wget() helper in web/includes/monitor_probe.php when processing camera discovery URLs containing user-supplied credentials. A remote user can submit a camera username such as a;touch /tmp/zm_probe_marker;# or a password containing shell metacharacters through the camera discovery request to inject commands into the URL passed to exec() and execute arbitrary operating system commands as the web server user.
Exploitation requires Monitors Create or Edit privileges and a deployment where camera discovery reaches a wget()-based vendor helper such as Hikvision, Avigilon, or Vivotek.
Remediation
Install update from vendor's website.