CVE-2025-60787 affects MotionEye v0.43.1b4 and earlier, where unsanitized input in configuration parameters (e.g., image_file_name) allows remote authenticated administrators to inject OS commands. These commands are written into Motion configuration files and executed upon restarting the Motion service, enabling code execution. The vulnerability involves improper input validation (CWE-20), OS command injection (CWE-78), and improper neutralization of input during logging or command execution (CWE-116). No patch or official remediation has been indicated in the provided data.

Successful exploitation allows remote authenticated users with admin privileges to execute arbitrary OS commands on the host system by injecting malicious input into configuration parameters. This can lead to full system compromise, including confidentiality, integrity, and availability impacts as reflected by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and avoid restarting the Motion service with untrusted configuration changes. Monitor vendor channels for updates and apply patches promptly once released.