Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-25643 is a critical-severity OS Command Injection (CWE-78) vulnerability in Frigate Frigate. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25643 is a critical remote command execution (RCE) vulnerability affecting Frigate, an open-source network video recorder (NVR) with realtime local object detection for IP cameras, in versions prior to 0.16.4. The issue resides in the Frigate integration with go2rtc, where the application fails to sanitize user input within the video stream configuration file (config.yaml). This allows attackers to inject arbitrary system commands using the exec: directive, which the go2rtc service then executes without restrictions. The vulnerability is associated with CWEs-78 (OS Command Injection), CWE-250 (Execution with Unnecessary Privileges), CWE-269 (Improper Privilege Management), and CWE-668 (Excessive Exposure of Sensitive Information to an Unauthorized Process), and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Exploitation requires high privileges, specifically an administrator account, though it becomes accessible to unauthenticated remote attackers if the Frigate installation is exposed to the open internet without authentication controls. Successful exploitation grants full administrative control over the system, enabling complete confidentiality, integrity, and availability impacts through arbitrary command execution on the host.
The vulnerability has been addressed in Frigate version 0.16.4, as detailed in the official release notes and GitHub security advisory GHSA-4c97-5jmr-8f6x. Security practitioners should immediately upgrade to 0.16.4 or later, ensure Frigate instances are not exposed to the public internet without authentication, and review config.yaml files for any malicious exec: directives.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5586
Vulnerability Data
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user…
more
input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote code execution via OS command injection in a public-facing NVR application (T1190), facilitating arbitrary command execution through a Unix shell interpreter (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the command injection flaw by requiring timely installation of the patch in Frigate version 0.16.4.
Validates and sanitizes user inputs in the config.yaml file to block injection of arbitrary system commands via the exec: directive.
Enforces least privilege on the go2rtc service to restrict the scope and impact of any executed commands from injected inputs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-05 directly enforces least privilege so largely eliminates CWE-250 at design time, yet the weakness can still arise from runtime escalation paths, third-party code, or misapplied role definitions outside this single control.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.
Network segmentation and unauthorized-access protections reduce the chance of resources being reachable by the wrong sphere.
Config baselines and default reviews can enforce some privilege-related settings (one facet) but do not address code-level assignment/tracking logic that defines CWE-269.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.
Restricting privileged utilities to the fewest trusted users and requiring explicit authorization directly stops developers or operators from embedding or invoking code that runs with unnecessary elevated rights.
Mandating separate non-privileged identities for routine work and restricting privileged accounts to administrative tasks reduces the chance that everyday operations run with unnecessary elevated rights.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.
Dynamic techniques that grant the minimum necessary rights for a given time window and revoke them afterward reduce the window in which excessive or unnecessary privileges can be exploited.
The control explicitly calls for minimizing privileged identities and disabling unnecessary accounts, thereby reducing the number of processes that run with unnecessary privileges.