Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-30971— ZoneMinder: Authenticated RCE via command injection in monitor Device Path

Quick assessment

Affected
ZoneMinder zoneminder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZoneMinder 是一款免费、开源的闭路电视（CCTV）软件应用程序。在 1.39.2、1.38.2 和 1.36.40 版本之前，当拥有“监控创建”或“监控编辑”权限的已认证用户保存一个“本地监控”配置，且该配置的“设备路径”字段包含 shell 元字符时，ZoneMinder 会将未经验证的监控设备字段拼接到 PHP 和 Perl 控制路径中的 shell 命令里。在此攻击机制中，存储的设备值会在 的参数净化（detainting）之前，被传递给 Perl 的 或反引号执行函数；而独立的 PHP 命令路径则

CVSS 8.8 · High

Affected Version Matrix 3

VendorProduct Version RangeStatus
ZoneMinder zoneminder < 1.36.40 affected
>= 1.38.0, < 1.38.2 affected
>= 1.39.0, < 1.39.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-30971

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ZoneMinder: Authenticated RCE via command injection in monitor Device Path
Source: CVE Program / CVE List V5
Vulnerability Description
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ZoneMinder zoneminder < 1.36.40 -

II. Public POCs for CVE-2026-30971

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-30971

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-30971 (1)

Vendor Advisories for CVE-2026-30971 (1)

Same Patch Batch · ZoneMinder · 2026-10-16 · 3 CVEs total

CVE-2026-102608 9.0 CRITICAL ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event expor
CVE-2026-102607 8.8 HIGH ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature

IV. Related Vulnerabilities

Same product: zoneminder
Same vendor: ZoneMinder
Same weakness: CWE-78

V. Comments for CVE-2026-30971

No comments yet

Leave a comment