Skip to content
Fencer Vulns
high 7.2

CVE-2023-26035 in the critical feed json

ZoneMinder vulnerable to Missing Authorization

published 2023-02-25 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-29921

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
80.5%
EPSS 80.5% chance of exploitation in 30 days, percentile 99.6%
public exploits
1
Metasploit, plus a Nuclei check

Summary

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.

Patch / fix

  • zoneminder zoneminder 1.36.33, 1.37.33
  • zoneminder Debian 14, Debian 13, Debian 12 1.36.33+dfsg1-1

debian advisories DEBIAN-CVE-2023-26035

  • zoneminder Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 1.36.33-r0

alpine advisories ALPINE-CVE-2023-26035

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Timeline

  1. First public exploit (Metasploit exploit/unix/webapp/zoneminder_snapshots)
  2. Published

Exploit prediction

80.46% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • ZoneMinder zoneminder

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.