# CVE-2022-39291: ZoneMinder - RCE

> Live exploitation tracking for CVE-2022-39291 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-39291

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.4
- **Public exploit available:** Yes
- **Affected products:** ZoneMinder
- **Weaknesses:** CWE-20 (Improper Input Validation)
- **Tags:** web_application

## Description

ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.

## CrowdSec analysis

[CVE-2022-39291](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-39291) is a vulnerability in ZoneMinder that allows users with `View` system permissions to inject new data into the logs, potentially affecting database performance and consuming storage resources. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade.

CrowdSec has been tracking this vulnerability and its exploits since 20th of December 2022.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-39291 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

This vulnerability is exploited by making crafted HTTP POST requests to the `/zm/index.php` endpoint, containing log information. The lack of rate limiting allows for excessive submissions, impacting database performance.

## Timeline

- 2022-10-07: CVE Published. CVE-2022-39291 is published to NVD.
- 2022-12-20: Rule Released. CrowdSec releases a rule to detect CVE-2022-39291 exploitation attempts against the CrowdSec Network.
- 2026-09-21: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-39291 for the first time.

## References

- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-cfcx-v52x-jh74
- https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4
- https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb238506388798d3cf92546f9e40c
- https://github.com/ZoneMinder/zoneminder/commit/cb3fc5907da21a5111ae54128a5d0b49ae755e9b
- https://github.com/ZoneMinder/zoneminder/commit/de2866f9574a2bf2690276fad53c91d607825408

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-39291) follows observed exploitation activity for CVE-2022-39291. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.