CVE-2026-30971 ZoneMinder CVE debrief

Who should care

System administrators and security teams responsible for ZoneMinder installations, particularly those with exposed or internet-facing deployments, should assess their exposure and prioritize patching or mitigating the vulnerability.

Why it matters

Authenticated RCE via command injection in ZoneMinder monitor Device Path allows attackers to execute arbitrary commands, potentially disrupting CCTV operations and posing a risk to adjacent systems. System administrators and security teams should assess exposure and prioritize patching or mitigation efforts.

• Potential for attackers to execute arbitrary commands as the web server user.
• Possible disruption of CCTV monitoring and recording capabilities.
• Risk of lateral movement or exploitation of adjacent systems.
• Need for verification of current exposure and remediation efforts.

Technical summary

ZoneMinder, a free and open-source closed-circuit television software application, is vulnerable to authenticated remote code execution (RCE) via command injection in the monitor Device Path. An attacker with monitor-create or monitor-edit permission can inject shell metacharacters into the Device Path, leading to arbitrary command execution as the web server user. The vulnerability affects versions prior to 1.39.2, 1.38.2, and 1.36.40.

Defensive priority

High

Recommended defensive actions

• Review and apply vendor patches (versions 1.39.2, 1.38.2, and 1.36.40) to address the vulnerability.
• Restrict monitor-create and monitor-edit permissions to trusted users.
• Implement additional security measures, such as input validation and sanitization, for monitor Device Paths.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and references to vendor advisories. The vulnerability has been fixed in versions 1.39.2, 1.38.2, and 1.36.40. The CVE record was published on 2026-10-16T19:40:51.681Z and has not been modified since then. The source item provides additional information on the vulnerability, and there are references to additional sources for further details. The vulnerability is considered high severity, with a CVSS score of 8.8. The CVE Program record and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.