Detections
Analytics

SCA: security update for motioneye (GHSA-rhgp-6wq6-9j67)

medium Tenable Cloud Security Plugin ID 443755

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - motionEye (mEye) is an online interface for motion software, a video surveillance program with motion
 detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644
 permissions (-rw-r--r--), making it readable by any local user on the system. This file contains sensitive
 data including the admin password hash, which can be leveraged by other vulnerabilities to escalate
 privileges. Additionally, per-camera configuration files (camera-*.conf) are also created with the same
 644 permissions, potentially exposing camera-specific credentials and settings. The exposed SHA1 admin
 password hash can be cracked offline to recover the plaintext password, used directly to forge
 authenticated admin API requests via the signature authentication weakness (GHSA-45h7-499j-7ww3), and
 chained with the OS command injection flaw (CVE-2025-60787) to escalate a local unprivileged user to the
 Motion daemon user (often root), enabling full system compromise. This issue has been fixed in version
 0.44.0. (CVE-2026-32315)

Solution

Update the motioneye library and its related packages to version 0.44.0 or later.

See Also

https://github.com/advisories/GHSA-rhgp-6wq6-9j67

Plugin Details

Severity: Medium

ID: 443755

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 6/22/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2026-32315

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/22/2026

Vulnerability Publication Date: 6/22/2026

Reference Information

CVE: CVE-2026-32315

cwe: CWE-732