Critical OS Command Injection Vulnerability in ZoneMinder Exposes Systems to RCE
CISA has issued an advisory for ZoneMinder versions 1.37.48 and 1.38.3, detailing CVE-2026-76060, a critical OS Command Injection vulnerability that allows authenticated users to execute arbitrary commands.
CISA has issued a critical advisory for ZoneMinder, a widely used video surveillance software, detailing a severe OS Command Injection vulnerability identified as CVE-2026-76060. This flaw affects ZoneMinder versions 1.37.48 and 1.38.3, and poses a significant risk to systems running these versions.
The vulnerability stems from the improper handling of the exportFile HTTP request parameter within ZoneMinder's event export functionality. When this parameter is passed unsanitized into a shell command executed via PHP's exec() function, it creates an opening for malicious actors. Any authenticated user with 'View Events' permission can leverage this weakness to inject and execute arbitrary operating system commands on the server.
Successful exploitation of CVE-2026-76060 could lead to full Remote Code Execution (RCE) as the web server user. This level of access would allow an attacker to take complete control of the affected server, potentially leading to data theft, system disruption, or further network compromise. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) and a CVSS v4.0 score of 8.7 (HIGH), underscoring its severity.
CISA discovered a public Proof of Concept (PoC) for this vulnerability, authored by Scriptkittens, and reported it to ZoneMinder. While no known public exploitation specifically targeting this vulnerability has been reported to CISA at this time, the existence of a PoC significantly increases the risk of active exploitation.
ZoneMinder has released a vendor fix, recommending that users upgrade to version 1.38.3 or later. Users can download the latest installer from the official ZoneMinder website or obtain the source code from their GitHub repository. Further details and security advisories are available on ZoneMinder's GitHub security page.
CISA strongly advises users to take defensive measures to minimize the risk of exploitation. These measures include minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating control system networks behind firewalls. When remote access is necessary, more secure methods like VPNs should be employed, with the caveat that VPNs themselves must be kept up-to-date.
Organizations are encouraged to perform thorough impact analyses and risk assessments before implementing defensive measures. CISA also provides extensive resources on its ICS webpage, including best practices for industrial control systems cybersecurity and guidance on targeted cyber intrusion detection and mitigation strategies.
This advisory serves as a critical reminder of the ongoing threats to industrial control systems and the importance of timely patching and robust network security practices. The presence of a public PoC for such a critical vulnerability necessitates immediate attention from all ZoneMinder users to prevent potential compromise.