CVE-2023-31493
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A Remote Code Execution (RCE) vulnerability in ZoneMinder through version 1.36.33 allows an attacker to create a new .php log file in the language folder. By executing a crafted payload, the attacker can escalate privileges and execute arbitrary commands on the remote system.
Risk Assessment
The risk for the organization includes full compromise of the ZoneMinder server, potentially leading to data theft, disruption of video surveillance, and further attacks on the network infrastructure.
Recommendation
Immediately update ZoneMinder to version 1.36.34 or later, which includes a fix for this vulnerability. Additionally, restrict permissions to language directories and implement intrusion detection mechanisms.
Original NVD description (English source)
RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system.