CVE-2025-60787
HIGH 7.2EPSS 18.5%
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.
- CVSS v3.1
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- 18.46% chance of exploitation in the next 30 days, 97th percentile
- Published
- 2025-10-03
- Updated
- 2026-07-05
Proof-of-concept exploits (8)
- advisories/GHSA-j945-qm58-4gjx
- Rohitberiwala/CVE-2025-60787-MotionEye-RCE
- agent-skywalker/CVE-2025-60787
- d3vn0mi/CVE-2025-60787-POC
- gunzf0x/CVE-2025-60787
- lil0xplorer/CVE-2025-60787_PoC
- ozcanpng/CVE-2025-60787
- prabhatverma47/CVE-2025-60787