A remote code execution vulnerability in ZoneMinder allows authenticated attackers to perform OS command injection, threatening the integrity and confidentiality of the host system.

This is an OS command injection vulnerability (CWE-78) where insufficient input validation allows an authenticated user to inject malicious commands into the system shell. This can lead to unauthorized code execution with the permissions of the application process.

Successful exploitation allows an attacker to gain a foothold on the server, potentially leading to a complete compromise of the surveillance infrastructure. With a CVSS score of 8.8, this flaw represents a significant risk to the security of the broader network where the ZoneMinder instance resides.

Immediate Action: Contact the vendor for information regarding available security patches, as version 1.39.17 is currently identified as affected without a clear patch version.

Proactive Monitoring: Review system logs for suspicious process spawning or unauthorized access attempts originating from authenticated sessions.

Compensating Controls: Use a Web Application Firewall to filter malicious payloads and ensure that the application is running with the least privilege necessary to limit the impact of a potential exploit.

Public Exploit Available: Unknown

Due to the high severity of this command injection vulnerability, users must prioritize the security of their ZoneMinder deployments. Organizations should restrict access to the application to trusted personnel only and actively monitor for vendor updates to address this flaw as soon as a patch becomes available.