CVE-2025-60787
HIGH 7.2EPSS 18.5%
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.
- CVSS v3.1 CNA
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- 18.46% chance of exploitation in the next 30 days, 97th percentile
- Published
- 2025-10-03
- Updated
- 2026-07-05
Proof-of-concept exploits (9)
- advisories/GHSA-j945-qm58-4gjx
- Rohitberiwala/CVE-2025-60787-MotionEye-RCE1★ · 2026-03-12
- agent-skywalker/CVE-2025-607870★ · 2026-03-14
- d3vn0mi/CVE-2025-60787-POC0★ · 2026-03-13
- gunzf0x/CVE-2025-6078710★ · 2026-03-08
- lil0xplorer/CVE-2025-60787_PoC2★ · 2026-03-08
- ozcanpng/CVE-2025-607870★ · 2026-07-10
- prabhatverma47/CVE-2025-607870★ · 2025-10-03
- diamorphine666/CVE-2025-607870★ · 2026-10-03