CVE-2025-47782 json
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
published 2025-05-14 17 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-14950 , GHSA-g5mq-prx7-c588 , PYSEC-2025-39
- cvss
- 8.9
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.
Patch / fix
- pypi motioneye 0.43.1b4
- motioneye_project motioneye 0.43.1b4
- github.com/motioneye-project/motioneye#3143 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 17 mo ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P |
| CNA | 4.0 | 8.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | motioneye | >=0.43.1b1, <0.43.1b4 |
0.43.1b4 |
Affected products
- motioneye-project motioneye
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/motioneye-project/motioneye/pull/3143
web
-
github.com
/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588
exploit, web, advisory
-
github.com
/motioneye-project/motioneye/issues/3142
web, report
-
nvd.nist.gov
/vuln/detail/CVE-2025-47782
advisory
-
github.com
/motioneye-project/motioneye
package
-
github.com
/pypa/advisory-database/tree/main/vulns/motioneye/PYSEC-2025-39.yaml
web
Sources
- CVE List CVE-2025-47782
- GitHub Advisory GHSA-g5mq-prx7-c588
- NVD CVE-2025-47782
- OSV PYSEC-2025-39
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.