CVE-2013-0232

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote...

7.5 HighPublic exploitFix available

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.

Exploit likelihood

47.9%Down 4.9 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2013-0232
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-0232
Updated: 2026-11-02

EUVDEUVD-2013-0266 No score

Record: EUVD-2013-0266
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c4jr-gf6w-2x72 No score

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote...

Record: GHSA-c4jr-gf6w-2x72
Updated: 2026-11-02

OSV No score

Record: CVE-2013-0232
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-0232 No score

Record: DEBIAN-CVE-2013-0232
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-0232 No score

Record: UBUNTU-CVE-2013-0232
Updated: 2026-11-02

Affected products

zoneminder

Affected packages

Affected packages
Package	Affected	Fixed
`zoneminder` Debian:12	before 1.25.0-4	1.25.0-4
`zoneminder` Debian:13	before 1.25.0-4	1.25.0-4
`zoneminder` Debian:14	before 1.25.0-4	1.25.0-4
`zoneminder` Debian:6.0 From an advisory covering 2 CVEs	before 1.24.2-8+squeeze1, plus listed versions 1.24.2-8	1.24.2-8+squeeze1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	ZoneMinder Video Server packageControl Command Execution	2013-01-22
Exploit-DB	ZoneMinder Video Server - packageControl Command Execution (Metasploit)	2013-01-24

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-0232 is a high vulnerability (CVSS 7.5) in Zoneminder, published March 14, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 47.9%, the 98th percentile. Fixed in zoneminder 1.25.0-4.

References

Show 8 moreShow less