{"id":"CVE-2026-25643","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-25643","generatedAt":"2026-10-28T02:13:37.228Z","title":"Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc.","description":"Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.","published":"2026-02-06T20:16:12.000Z","lastModified":"2026-06-17T10:25:00.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-78","CWE-250","CWE-269","CWE-668"],"affected":["frigate/frigate"],"epss":{"score":0.03031,"percentile":0.87397,"date":"2026-10-26","history":[{"date":"2026-10-25","score":0.03031,"percentile":0.8739}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2026-04-30","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":52533,"kind":"exploit","title":"Frigate NVR 0.16.3 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/52533","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52533.py","file":"exploits/multiple/webapps/52533.py","published":"2026-04-30","added":"2026-04-30","updated":"2026-04-30","author":"jduardo2704","type":"webapps","platform":"multiple","port":null,"verified":false,"codes":["CVE-2026-25643"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"A public exploit is published in Exploit-DB and the impact is critical, while EPSS rates exploitation at 3.0%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use."},"changes":[],"references":[{"url":"https://github.com/blakeblackshear/frigate/releases/tag/v0.16.4","tags":["Release Notes"],"source":"security-advisories@github.com"},{"url":"https://github.com/blakeblackshear/frigate/security/advisories/GHSA-4c97-5jmr-8f6x","tags":["Exploit","Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/blakeblackshear/frigate/security/advisories/GHSA-4c97-5jmr-8f6x","tags":["Exploit","Vendor Advisory"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-25643","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}