A critical OS command injection vulnerability in ZoneMinder allows authenticated attackers to execute arbitrary system commands, posing a severe risk of unauthorized server control.

This vulnerability is an OS command injection (CWE-78) occurring within the event export functionality. The application fails to sanitize the exportFile HTTP parameter before passing it to a shell command, allowing any authenticated user with View Events permission to achieve remote code execution.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary operating system commands with the privileges of the web server. This could lead to a complete system compromise, unauthorized data access, or the deployment of persistent threats within the internal network. With a CVSS score of 8.8, this flaw represents a significant risk to organizational infrastructure and data confidentiality.

Immediate Action: Upgrade Zoneminder to version 1.38.3 or later as specified by the vendor's security advisory.

Proactive Monitoring: Monitor server logs for suspicious process spawning, particularly those involving shell execution or unusual activity originating from the event export module.

Compensating Controls: Implement strict network access controls to limit access to the ZoneMinder interface and utilize a Web Application Firewall (WAF) to inspect and block requests containing suspicious shell metacharacters in the exportFile parameter.

Public Exploit Available: No (exploit_available: false)

Given the potential for remote code execution, this vulnerability poses a high risk to environment security. Administrators must prioritize updating to version 1.38.3 immediately to eliminate the injection vector and secure the underlying server against unauthorized command execution.