Zoneminder

{"#Zoneminder Vulnerability":"The Zoneminder software contains a critical vulnerability that allows authenticated users to execute arbitrary commands on the server. This is a severe OS Command Injection issue, with a CVSS score of 8.8. The vulnerability is in the event export functionality, where the exportFile parameter is passed unsanitized into a shell command. Zoneminder recommends upgrading to version 1.38.3 or later to mitigate this risk.","#Vendor Response":"Zoneminder has provided a fix, offering both an installer for system upgrades and the source code from their GitHub repository. Users are advised to refer to their security advisories for more details.","#Impact and Mitigation":"This vulnerability impacts worldwide deployments of Zoneminder, affecting the Information Technology sector. Organizations are advised to minimize network exposure, use firewalls, and update to the latest version to protect against exploitation. CISA recommends proactive defense strategies and social engineering protection measures."}