A local buffer overflow vulnerability in Frigate 3 Professional allows an attacker to execute arbitrary code with the privileges of the application user.

The application is susceptible to a classic buffer overflow (CWE-120) triggered via the Command Line input field. By providing a specially crafted input sequence, an unauthenticated local attacker can overflow the buffer, bypass Data Execution Prevention (DEP), and execute arbitrary commands.

A successful exploit allows an attacker to execute arbitrary code on the host system, leading to full system compromise or unauthorized access to local resources. Given the CVSS score of 8.4, this vulnerability represents a high risk to business operations, as it can be leveraged to install malware, exfiltrate sensitive local data, or pivot into other parts of the internal network.

Immediate Action: As there is no official patch currently available, users should restrict access to the Frigate 3 Professional application to authorized personnel only to prevent local exploitation.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious process executions or abnormal command-line activity originating from the Frigate 3 application process.

Compensating Controls: Implement host-based security controls, such as Endpoint Detection and Response (EDR) solutions, to detect and block unauthorized child processes spawned by the Frigate 3 executable.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the Exploit-DB entry 48563.

Due to the lack of an available patch, organizations currently utilizing Frigate 3 Professional should treat this as a high-priority risk. It is strongly recommended to isolate the affected systems or transition to a supported alternative to mitigate the risk of local code execution.