Which products and versions are affected by CVE-2022-25568?

Affected: Motioneye (Motioneye Project). The full list is in the CVE brief.

Is CVE-2022-25568 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2022-25568 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2022-25568?

No public exploit code is known.

Is there a fix for CVE-2022-25568?

Fixed versions are available, including Motioneye 0.43.1b1, Motioneye <=0.42.1, Motioneye 0.42.1.

How urgently should CVE-2022-25568 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

Vulnerability Intelligence

CVE-2022-25568

Q: What is CVE-2022-25568?

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list.

Q: How urgently should CVE-2022-25568 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

High

MotionEye allows attackers to access sensitive information

Published Mar 25, 2022 · Updated Aug 12, 2026 · Also known as GHSA-2c7w-v459-cwgf, PYSEC-2022-43141

Key Facts

Patch in the next maintenance window

CVE-2022-25568 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Motioneye (Motioneye Project).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 6.9% probability of exploitation in the next 30 days.
Fixed versions are available, including Motioneye 0.43.1b1, Motioneye <=0.42.1, Motioneye 0.42.1.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

6.9%

Higher than 93.9% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2022-25568 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.

Affected Products

2 affected entries in total

Product	Affected versions	Fixed in
MotioneyeMotioneye Project	See advisory	0.42.1

Patched Releases

Motioneye

0.43.1b1, <=0.42.1

Timeline

Publicly disclosed
Mar 25, 2022
Last updated
Aug 12, 2026

Weakness Type

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1188 Initialization of a Resource with an Insecure Default

References

4 more references in the full CVE brief

FAQ

Common Questions.

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list.
Affected: Motioneye (Motioneye Project). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Motioneye 0.43.1b1, Motioneye <=0.42.1, Motioneye 0.42.1.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Is CVE-2022-25568 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo