CVE Feed

    Dashboard / CVE / CVE-2022-25568

    CVE-2022-25568

    MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.

    Published:Mar 24, 2022
    Last Modified:Nov 21, 2024
    EPS:Mar 24, 2022
    EPSS Score:0.89768
    CVSS Score:7.5

    Affected Products

    Vendor
    Motioneye Project
    Product
    Motioneye

    Exploits

    https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure/https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure/

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-32315 (CVSS 5.5) — motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detectio…
    CVE-2026-31978 (CVSS 6.5) — motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion…
    CVE-2026-55488 (CVSS 7.7) — motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance…
    CVE-2025-60787 (CVSS 7.2) — MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image…
    CVE-2025-47782 (CVSS 8.9) — motionEye is an online interface for the software motion, a video surveillance program with motion detection. …
    CVE-2021-44255 (CVSS 7.2) — Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attack…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High