CVE-2025-60787
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
A vulnerability in MotionEye v0.43.1b4 and earlier allows OS command injection via configuration parameters like image_file_name. Unsanitized user input is written to Motion configuration files, enabling remote authenticated attackers with admin access to execute code when Motion is restarted.
Risk Assessment
The organization risks full server compromise by an attacker with admin privileges, potentially leading to data theft, malware installation, or further attacks on the internal network.
Recommendation
Immediately update MotionEye to the latest version and restrict administrative access to trusted IP addresses. Additionally, implement input validation for Motion configuration parameters.
Original NVD description (English source)
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.