p PatchFirst

CVE-2026-30971

CVE-2026-30971 · ZoneMinder: Authenticated RCE via command injection in monitor Device Path

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.

CVSS 8.8 · High · EPSS 1.1%

Published
Updated

Stack: system

Affected products and versions

  • zoneminder

    Versions
    • < 1.36.40: Affected
    • >= 1.38.0, < 1.38.2: Affected
    • >= 1.39.0, < 1.39.2: Affected

    No fix published

  • zoneminder Debian:12

    Versions
    • 1.36.33+dfsg1-1
    • 1.36.35+dfsg1-1
    • 1.36.37+dfsg1-1
    • 1.36.37+dfsg1-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Debian:13

    Versions
    • 1.36.35+dfsg1-1
    • 1.36.37+dfsg1-1
    • 1.36.37+dfsg1-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Debian:14

    Versions
    • 1.36.35+dfsg1-1
    • 1.36.37+dfsg1-1
    • 1.36.37+dfsg1-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:Pro:16.04:LTS

    Versions
    • 1.28.1-8
    • 1.29.0+dfsg-1
    • 1.29.0+dfsg-1ubuntu1
    • 1.29.0+dfsg-1ubuntu2
    • 1.29.0+dfsg-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:Pro:20.04:LTS

    Versions
    • 1.32.3-2build1
    • 1.32.3-2ubuntu1
    • 1.32.3-2ubuntu2
    • 1.32.3-2ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:Pro:22.04:LTS

    Versions
    • 1.36.7+dfsg1-1
    • 1.36.10+dfsg1-1
    • 1.36.11+dfsg1-1
    • 1.36.12+dfsg1-1
    • 1.36.12+dfsg1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:24.04:LTS

    Versions
    • 1.36.33+dfsg1-1build1
    • 1.36.33+dfsg1-1build2
    • 1.36.33+dfsg1-1build3
    • 1.36.33+dfsg1-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:26.10

    Versions
    • 1.36.37+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:26.04:LTS

    Versions
    • 1.36.35+dfsg1-1
    • 1.36.37+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →