Unrated severityNVD Advisory· Published Mar 20, 2013· Updated Apr 29, 2026
CVE-2013-0232
CVE-2013-0232
Description
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.
Affected products
6cpe:2.3:a:zoneminder:zoneminder:1.24.0:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:zoneminder:zoneminder:1.24.0:*:*:*:*:*:*:*
- cpe:2.3:a:zoneminder:zoneminder:1.24.1:*:*:*:*:*:*:*
- cpe:2.3:a:zoneminder:zoneminder:1.24.2:*:*:*:*:*:*:*
- cpe:2.3:a:zoneminder:zoneminder:1.24.3:*:*:*:*:*:*:*
- cpe:2.3:a:zoneminder:zoneminder:1.24.4:*:*:*:*:*:*:*
- cpe:2.3:a:zoneminder:zoneminder:1.25.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/nvdExploit
- bugs.debian.org/cgi-bin/bugreport.cginvd
- www.debian.org/security/2013/dsa-2640nvd
- www.exploit-db.com/exploits/24310nvd
- www.openwall.com/lists/oss-security/2013/01/28/2nvd
- www.osvdb.org/89529nvd
- www.zoneminder.com/forums/viewtopic.phpnvd
News mentions
0No linked articles in our index yet.