CVE-2025-60787: MotionEye RCE Vulnerability via Command Injection

CVE-2025-60787 Overview

CVE-2025-60787 is an OS Command Injection vulnerability affecting MotionEye versions 0.43.1b4 and earlier. The flaw resides in configuration parameters such as image_file_name, where unsanitized user input is written directly into Motion configuration files. Authenticated attackers with administrative access can inject arbitrary operating system commands that execute when the Motion process restarts. The issue is categorized under [CWE-20: Improper Input Validation]. MotionEye is a web-based frontend for the Motion video surveillance daemon, commonly deployed on Linux hosts and Raspberry Pi devices for home and small-business camera monitoring.

Critical Impact

Remote authenticated attackers with admin privileges can achieve arbitrary code execution on the host running MotionEye, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

• MotionEye 0.42.1
• MotionEye 0.43.1 beta1 through beta4
• All MotionEye releases prior to and including 0.43.1b4

Discovery Timeline

• 2025-10-03 - CVE-2025-60787 published to the National Vulnerability Database
• 2025-10-10 - Last updated in NVD database

Technical Details for CVE-2025-60787

Vulnerability Analysis

MotionEye exposes a web administration interface that allows operators to configure Motion daemon parameters. Configuration values entered through the admin UI are persisted to Motion configuration files on disk. The application fails to sanitize input written to fields such as image_file_name before storing them in these configuration files.

When the Motion daemon is restarted, it parses these configuration files and interprets attacker-controlled values as part of command strings. This results in arbitrary OS command execution under the privileges of the Motion process. Because MotionEye is commonly run as root or a privileged service account on appliance-style deployments, successful exploitation often yields complete host control.

The vulnerability requires authenticated administrative access. However, MotionEye deployments frequently use default or weak credentials, and the interface is often exposed beyond trusted networks. The presence of an Exploit-DB entry and a public GitHub proof-of-concept further increases the practical exploitation risk.

Root Cause

The root cause is improper input validation [CWE-20]. MotionEye writes configuration parameter values directly into Motion configuration files without escaping shell metacharacters or restricting character sets. Fields like image_file_name are later evaluated in contexts that permit command interpretation, breaking the trust boundary between configuration data and executable content.

Attack Vector

An attacker authenticates to the MotionEye web interface as an administrator. The attacker submits a crafted value containing shell metacharacters or command substitution sequences into a vulnerable configuration field such as image_file_name. MotionEye saves the payload to the Motion configuration file. When Motion is restarted, either by the attacker triggering a configuration reload or by routine service restart, the injected commands execute on the host.

For technical exploitation details, see the GitHub RCE PoC Repository.

Detection Methods for CVE-2025-60787

Indicators of Compromise

• Unexpected shell metacharacters such as ;, |, `, or $( appearing in Motion configuration files including motion.conf and per-camera thread-*.conf files.
• Anomalous child processes spawned by the motion or motioneye parent process, particularly shells such as /bin/sh, bash, nc, curl, or wget.
• Unexpected outbound network connections originating from the host running MotionEye.
• New cron jobs, SSH authorized keys, or systemd units created shortly after MotionEye configuration changes.

Detection Strategies

• Monitor process trees for the motion binary spawning interactive shells or networking utilities.
• Audit MotionEye configuration files for non-printable characters or shell syntax in parameters that should contain filenames or paths.
• Review MotionEye admin interface authentication logs for unexpected logins or session activity from unfamiliar IP addresses.

Monitoring Recommendations

• Enable file integrity monitoring on the MotionEye configuration directory, typically /etc/motioneye/ and /etc/motion/.
• Forward MotionEye and Motion service logs to a centralized SIEM and alert on service restarts correlated with configuration writes.
• Track network egress from camera and IoT subnets where MotionEye is deployed and flag connections to non-baseline destinations.

How to Mitigate CVE-2025-60787

Immediate Actions Required

• Restrict access to the MotionEye administrative interface to trusted management networks using firewall rules or a reverse proxy with IP allowlisting.
• Rotate all MotionEye administrator credentials and verify no default passwords remain in use.
• Audit existing Motion configuration files for injected payloads and revert any suspicious values to known-good defaults.
• Reduce the privileges of the Motion and MotionEye service accounts so they do not run as root where feasible.

Patch Information

No official vendor patch URL is listed in the CVE record at the time of publication. Administrators should monitor the MotionEye Project Homepage and the project's GitHub releases for a fixed version superseding 0.43.1b4. Until a patched release is available, apply the workarounds below.

Workarounds

• Disable remote administrative access and require VPN connectivity to reach the MotionEye web interface.
• Enforce strong, unique credentials for all MotionEye administrator accounts and enable any available access logging.
• Run MotionEye and Motion inside a container or with a dedicated unprivileged service user to limit the blast radius of command execution.
• Manually review and lock down configuration file permissions so that only the service account can modify them.

# Example: restrict MotionEye admin interface to a management subnet using iptables
iptables -A INPUT -p tcp --dport 8765 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8765 -j DROP

# Example: run MotionEye under a dedicated non-root user
useradd -r -s /usr/sbin/nologin motioneye
chown -R motioneye:motioneye /etc/motioneye /var/lib/motioneye