CVE-2026-32315: motionEye Configuration File Permissions Exposure (Medium)

Technical summary

motionEye creates /etc/motioneye/motion.conf and camera-specific configuration files (camera-*.conf) with mode 644 (readable by all local users). These files contain sensitive data: SHA1 admin password hashes, camera URLs, credentials, and streaming settings. While the hash itself requires offline cracking, the vulnerability becomes severe when chained with CVE-2025-60787 (OS command injection) and GHSA-45h7-499j-7ww3 (signature authentication weakness). A local unprivileged user can read the hash, crack it offline, and use the recovered plaintext to forge authenticated API requests or escalate to the Motion daemon process (often running as root), resulting in full system compromise.

Business impact

Affected deployments risk unauthorized access to video surveillance systems and potential compromise of the underlying host. For organizations using motionEye in production environments, exposure of admin credentials via readable config files can lead to loss of video feed integrity, unauthorized recording/deletion, and lateral movement into the broader network if the Motion daemon runs with elevated privileges. Small-to-medium deployments and edge devices running motionEye as a security component face the highest operational risk.

Affected systems

All motionEye installations prior to version 0.44.0 are affected. The vulnerability is platform-agnostic (Linux, BSD, etc.) as long as the default file permission behavior applies. Deployments where the Motion daemon runs as root or a privileged service user face the highest risk of full system compromise.

Exploitability

Exploitation requires local access to the system, making this a low-barrier attack for internal actors, compromised accounts, or privilege-escalation chains. No authentication is needed to read the configuration files. The SHA1 password hash can be cracked within minutes using modern hardware or precomputed rainbow tables. When combined with publicly documented signature authentication weaknesses and command injection flaws, the attack path becomes straightforward and does not require sophisticated tooling.

Remediation

Upgrade motionEye to version 0.44.0 or later, which restricts configuration file permissions. After patching, manually verify that /etc/motioneye/motion.conf and camera-*.conf files have restricted permissions (600 or 640). If the affected system has been accessed by untrusted local users, treat the admin credentials as compromised: change the admin password immediately and audit any API access logs or video manipulation. Consider rotating camera credentials as well.

Patch guidance

Update motionEye to version 0.44.0 or later. Verify the integrity of configuration files post-upgrade by confirming file permissions are restricted (mode 600 or 640, not 644). If running in containerized environments, ensure the container image is rebuilt from an updated base. Test camera connectivity and admin authentication after patching to confirm proper operation.

Detection guidance

Search for /etc/motioneye/motion.conf and camera-*.conf files with world-readable permissions (mode 644 or similar) in production systems. Review access logs for motionEye admin API endpoints around the time of any configuration changes or suspicious video deletion/manipulation. Audit local user accounts that may have accessed these configuration files. Monitor for offline password-cracking activity and sudden elevation of Motion daemon privileges.

Why prioritize this

This vulnerability enables credential exposure and privilege escalation through local access. While the CVSS score is moderate (5.5), the real-world impact is amplified by chaining with OS command injection and authentication weaknesses already documented in the motionEye project. Organizations running motionEye as a production surveillance system or on internet-facing edge devices should prioritize patching, especially if the Motion daemon has elevated privileges or the system has multiple local users.

Risk score, explained

The CVSS:3.1 score of 5.5 (MEDIUM) reflects a local attack vector requiring user interaction at the file system level, with no direct impact on availability. However, the score understates the practical risk because: (1) configuration files are world-readable by design in unpatched versions, not requiring privilege escalation to read; (2) SHA1 hash cracking is commodity-level effort; (3) chaining with CVE-2025-60787 and GHSA-45h7-499j-7ww3 creates a complete privilege-escalation pipeline to root. Organizations should treat this as higher priority in environments where the Motion daemon runs with elevated privileges.

Frequently asked questions