CVE-2026-32315

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32315", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T21:16:21.660Z", "datePublished": "2026-06-24T20:45:34.326Z", "dateUpdated": "2026-06-25T12:36:19.974Z"}, "containers": {"cna": {"title": "motionEye: World-Readable Configuration File Exposes Admin Password Hash", "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "lang": "en", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-522", "lang": "en", "description": "CWE-522: Insufficiently Protected Credentials", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67"}, {"name": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0"}], "affected": [{"vendor": "motioneye-project", "product": "motioneye", "versions": [{"version": "< 0.44.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T20:45:34.326Z"}, "descriptions": [{"lang": "en", "value": "motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions (-rw-r--r--), making it readable by any local user on the system. This file contains sensitive data including the admin password hash, which can be leveraged by other vulnerabilities to escalate privileges. Additionally, per-camera configuration files (camera-*.conf) are also created with the same 644 permissions, potentially exposing camera-specific credentials and settings. The exposed SHA1 admin password hash can be cracked offline to recover the plaintext password, used directly to forge authenticated admin API requests via the signature authentication weakness (GHSA-45h7-499j-7ww3), and chained with the OS command injection flaw (CVE-2025-60787) to escalate a local unprivileged user to the Motion daemon user (often root), enabling full system compromise. This issue has been fixed in version 0.44.0."}], "source": {"advisory": "GHSA-rhgp-6wq6-9j67", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T12:36:16.343159Z", "id": "CVE-2026-32315", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T12:36:19.974Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "motionEye: World-Readable Configuration File Exposes Admin Password Hash", "source": {"advisory": "GHSA-rhgp-6wq6-9j67", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "motioneye-project", "product": "motioneye", "versions": [{"status": "affected", "version": "< 0.44.0"}]}], "references": [{"url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67", "name": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0", "name": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions (-rw-r--r--), making it readable by any local user on the system. This file contains sensitive data including the admin password hash, which can be leveraged by other vulnerabilities to escalate privileges. Additionally, per-camera configuration files (camera-*.conf) are also created with the same 644 permissions, potentially exposing camera-specific credentials and settings. The exposed SHA1 admin password hash can be cracked offline to recover the plaintext password, used directly to forge authenticated admin API requests via the signature authentication weakness (GHSA-45h7-499j-7ww3), and chained with the OS command injection flaw (CVE-2025-60787) to escalate a local unprivileged user to the Motion daemon user (often root), enabling full system compromise. This issue has been fixed in version 0.44.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T20:45:34.326Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32315", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T12:36:16.343159Z"}}}], "references": [{"url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-06-25T12:35:58.281Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-32315", "state": "PUBLISHED", "dateUpdated": "2026-06-24T20:45:34.326Z", "dateReserved": "2026-03-11T21:16:21.660Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-24T20:45:34.326Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "motioneye", "vendor": "motioneye-project", "versions": [{"status": "affected", "version": "< 0.44.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions (-rw-r--r--), making it readable by any local user on the system. This file contains sensitive data including the admin password hash, which can be leveraged by other vulnerabilities to escalate privileges. Additionally, per-camera configuration files (camera-*.conf) are also created with the same 644 permissions, potentially exposing camera-specific credentials and settings. The exposed SHA1 admin password hash can be cracked offline to recover the plaintext password, used directly to forge authenticated admin API requests via the signature authentication weakness (GHSA-45h7-499j-7ww3), and chained with the OS command injection flaw (CVE-2025-60787) to escalate a local unprivileged user to the Motion daemon user (often root), enabling full system compromise. This issue has been fixed in version 0.44.0."}, {"lang": "es", "value": "motionEye (mEye) es una interfaz en l\u00ednea para el software motion, un programa de videovigilancia con detecci\u00f3n de movimiento. Las versiones anteriores a la 0.44.0 crean el archivo de configuraci\u00f3n /etc/motioneye/motion.conf con permisos 644 (-rw-r--r--), haci\u00e9ndolo legible por cualquier usuario local en el sistema. Este archivo contiene datos sensibles, incluyendo el hash de la contrase\u00f1a de administrador, que puede ser aprovechado por otras vulnerabilidades para escalar privilegios. Adem\u00e1s, los archivos de configuraci\u00f3n por c\u00e1mara (camera-*.conf) tambi\u00e9n se crean con los mismos permisos 644, exponiendo potencialmente credenciales y configuraciones espec\u00edficas de la c\u00e1mara. El hash SHA1 de la contrase\u00f1a de administrador expuesto puede ser descifrado sin conexi\u00f3n para recuperar la contrase\u00f1a en texto plano, utilizado directamente para falsificar solicitudes API de administrador autenticadas a trav\u00e9s de la debilidad de autenticaci\u00f3n de firma (GHSA-45h7-499j-7ww3), y encadenado con la falla de inyecci\u00f3n de comandos del sistema operativo (CVE-2025-60787) para escalar un usuario local sin privilegios al usuario del demonio Motion (a menudo root), permitiendo el compromiso total del sistema. Este problema ha sido solucionado en la versi\u00f3n 0.44.0."}], "id": "CVE-2026-32315", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32315", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T12:36:16.343159Z", "version": "2.0.3"}}]}, "published": "2026-06-24T21:16:53.183", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-732"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.44.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "motioneye", "source": "cna", "vendor": "motioneye-project"}, "product": "motioneye", "vendor": "motioneye_project"}], "created": "2026-06-24T22:45:15.369352+00:00", "updated": "2026-10-26T14:30:13.669105+00:00", "vendors": ["motioneye_project", "motioneye_project$PRODUCT$motioneye"]}