CyberRota Analysis
AI-GeneratedA remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute operating system commands due to a flawed permission check in the Filter class. The exploitation of this flaw can lead to unauthorized access and control over the system, making it critical for organizations using this version of ZoneMinder to prioritize immediate remediation. All users with authentication can exploit this vulnerability, regardless of their assigned roles, heightening the urgency for security teams to address it.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.