Description
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zoneminder | 1.30.4+dfsg-1 | — |
| Debian 13 | zoneminder | 1.30.4+dfsg-1 | — |
| Debian 12 | zoneminder | 1.30.4+dfsg-1 | — |
| Debian 7 | zoneminder | 1.25.0-4+deb7u1 | DLA-806-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | zoneminder | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.23 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.22 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.21 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.20 | zoneminder | 1.30.2-r0 | — |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.18 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.17 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.16 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.15 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.14 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.13 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.12 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.11 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.10 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.9 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.8 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.7 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.6 | zoneminder | 1.30.2-r0 | — |
| Alpine v3.5 | zoneminder | 1.30.2-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
asaotomo/CVE-2016-10140-Zoneminder-Poc ★ 8 · Dec 21, 2021
Zoneminder 未授权访问批量检测工具：ZoneMinder v1.30和v1.29捆绑的Apache HTTP Server配置中存在信息泄露和认证绕过漏洞，允许远程未认证攻击者浏览web根目录下的所有目录。
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DLA-806-1 zoneminder - security update Debian Security (DSA / DLA) · Mar 9, 2026