CVE-2026-32315

{
  "id": "CVE-2026-32315",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T21:16:53.183",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions (-rw-r--r--), making it readable by any local user on the system. This file contains sensitive data including the admin password hash, which can be leveraged by other vulnerabilities to escalate privileges. Additionally, per-camera configuration files (camera-*.conf) are also created with the same 644 permissions, potentially exposing camera-specific credentials and settings. The exposed SHA1 admin password hash can be cracked offline to recover the plaintext password, used directly to forge authenticated admin API requests via the signature authentication weakness (GHSA-45h7-499j-7ww3), and chained with the OS command injection flaw (CVE-2025-60787) to escalate a local unprivileged user to the Motion daemon user (often root), enabling full system compromise. This issue has been fixed in version 0.44.0."
    },
    {
      "lang": "es",
      "value": "motionEye (mEye) es una interfaz en línea para el software motion, un programa de videovigilancia con detección de movimiento. Las versiones anteriores a la 0.44.0 crean el archivo de configuración /etc/motioneye/motion.conf con permisos 644 (-rw-r--r--), haciéndolo legible por cualquier usuario local en el sistema. Este archivo contiene datos sensibles, incluyendo el hash de la contraseña de administrador, que puede ser aprovechado por otras vulnerabilidades para escalar privilegios. Además, los archivos de configuración por cámara (camera-*.conf) también se crean con los mismos permisos 644, exponiendo potencialmente credenciales y configuraciones específicas de la cámara. El hash SHA1 de la contraseña de administrador expuesto puede ser descifrado sin conexión para recuperar la contraseña en texto plano, utilizado directamente para falsificar solicitudes API de administrador autenticadas a través de la debilidad de autenticación de firma (GHSA-45h7-499j-7ww3), y encadenado con la falla de inyección de comandos del sistema operativo (CVE-2025-60787) para escalar un usuario local sin privilegios al usuario del demonio Motion (a menudo root), permitiendo el compromiso total del sistema. Este problema ha sido solucionado en la versión 0.44.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "motioneye-project",
          "product": "motioneye",
          "versions": [
            {
              "version": "< 0.44.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T12:36:16.343159Z",
          "id": "CVE-2026-32315",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-522"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}