CVE-2022-25568 is a high-severity information disclosure vulnerability affecting MotionEye v0.42.1 and earlier, allowing unauthenticated attackers to access sensitive configuration data via a GET request to /config/list if a regular user password is not configured. This vulnerability has a CVSS score of 7.5, indicating a high impact on confidentiality with low attack complexity and no user interaction required. While there is no evidence of active exploitation or Metasploit modules, Nuclei templates exist for detection, and its high EPSS and FAUCET Risk Scores suggest a significant potential for future exploitation despite limited community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.42.1CPE matchmatch criteria | cpe:2.3:a:motioneye_project:motioneye:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.