CVE-2023-26035 Scanner
CVE-2023-26035 Scanner - Remote Code Execution (RCE) vulnerability in ZoneMinder
Used 3.4k times · 4.3k assets checked · domain, ipv4, subdomain
CVE
CVE-2023-26035
9.8
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
zoneminder
Updated Sep 28, 2026View on NVD →
S4E scanner
CVE history: zoneminder
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →