CyberRota Analysis
AI-GeneratedThe motionEye interface for the motion video surveillance program is vulnerable due to a lack of authentication in the ActionHandler.post() method, enabling unauthenticated remote attackers to send requests that can trigger critical camera actions, including snapshots and recording controls. This vulnerability poses a medium risk as it could lead to unauthorized access and manipulation of surveillance feeds. Organizations using versions prior to 0.44.0 should prioritize updating to the latest version to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.