PT-2025-21180 · Motioneye · Motioneye

Published 2025-05-14 · Updated 2025-05-15 · CVE-2025-47782

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: motionEye versions 0.43.1b1 through 0.43.1b3

Description: The issue allows an attacker with admin user credentials to execute any command within a non-interactive shell as the motionEye run user, motion by default, by using a constructed device path with the add/add camera motionEye web API.

Recommendations: For versions 0.43.1b1 through 0.43.1b3, update to motionEye v0.43.1b4 to resolve the issue. As a temporary workaround for versions 0.43.1b1 through 0.43.1b3, apply the patch manually.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-47782

GHSA-G5MQ-PRX7-C588

PYSEC-2025-39

Affected Products

Motioneye

References · 15

• 🔥 https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47782.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-47782 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47782 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5mq-prx7-c588 · Vendor Advisory
• https://github.com/motioneye-project/motioneye · Note
• https://github.com/motioneye-project/motioneye/pull/3143 · Note
• https://github.com/motioneye-project/motioneye/issues/3142 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/motioneye/PYSEC-2025-39.yaml · Note
• https://t.me/cvenotify/122193 · Telegram Post
• https://twitter.com/CVEnew/status/1922695627169046906 · Twitter Post
• https://t.me/cvetracker/23847 · Telegram Post
• https://t.me/latest_high_impact_cve/2366 · Telegram Post
• https://twitter.com/CveFindCom/status/1922684170138009625 · Twitter Post