ZoneMinder Command Injection CVE-2026-30971 Hits Authenticated Users

ZoneMinder, an open-source closed-circuit television application, contains a high-severity command injection vulnerability identified as CVE-2026-30971. According to the National Vulnerability Database, this flaw allows attackers to execute arbitrary commands within the web server context. The issue arises when authenticated users with specific permissions save monitor configurations. Environments running versions prior to 1.36.40, 1.38.2, and 1.39.2 are directly exposed to this risk.

How does the vulnerability work?

The flaw exists in how ZoneMinder handles the Device field for Local monitors. When a user with monitor-create or monitor-edit permissions saves a monitor, the application interpolates the unvalidated Device path into shell commands. According to the NVD record, this occurs in both PHP and Perl control paths. The stored value reaches Perl qx() and backtick execution functions before argument detainting happens in zmdc.pl.

In the PHP paths, the application relies on escapeshellcmd defenses that can be bypassed. If the Device Path contains shell metacharacters and the monitor control or startup path runs, the attacker gains command execution. This mechanism turns a configuration field into a vector for arbitrary code execution as the web server user.

Which versions are affected?

The vulnerability impacts specific version ranges of ZoneMinder. According to the source material, versions prior to 1.36.40 are affected. Additionally, versions 1.38.0 and later, up to but not including 1.38.2, are vulnerable. The same applies to versions 1.39.0 and later, up to but not including 1.39.2. Any installation running within these ranges lacks the necessary fixes to prevent the command injection.

Is there a fix available?

Yes, patches have been released for the affected versions. ZoneMinder version 1.39.2 includes the fix for the 1.39.x branch. Version 1.38.2 resolves the issue for the 1.38.x branch. Similarly, version 1.36.40 provides the correction for the 1.36.x branch. Users should verify their current version and apply the appropriate update to mitigate the risk of arbitrary command execution.

What is the severity rating?

The National Vulnerability Database rates CVE-2026-30971 as HIGH with a CVSS score of 8.8. This rating reflects the potential for remote code execution by authenticated attackers. The weakness is classified under CWE-78, which relates to OS Command Injection. The high score indicates that successful exploitation can lead to significant compromise of the underlying system running the ZoneMinder application.

Detection notes

Security operations teams should monitor web server logs for unusual shell metacharacters in HTTP requests related to monitor configuration endpoints. Look for failed command executions or unexpected process spawns originating from the web server user. Check for new or modified Local monitor entries with suspicious Device Path values. If anomalous behavior is detected, isolate the affected server immediately to prevent lateral movement. Review access logs to identify the authenticated user account involved in the configuration change.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe

• Update ZoneMinder to version 1.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.