The vulnerability arises from an incorrectly implemented permission check in the ZoneMinder Filter class. Triggering this flaw bypasses the intended authorization check because canEdit() and canDelete() invoke nonexistent methods on the ZM\User class. PHP's __call() then returns a truthy value, granting the caller full permission to execute filter-based OS commands. This flaw is a classic command‑injection weakness identified as CWE‑78 and can be used to run arbitrary code on the host machine.

ZoneMinder 1.39.17 is the only version documented as affected. The flaw exists in this release of the ZoneMinder software, and no other vendor or product variants are listed in the advisory.

The CVSS score of 8.8 marks the flaw as high severity, indicating a significant risk if exploited. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting that no widespread exploit has been observed yet. Nevertheless, the flaw requires authentication; any valid user may launch the attack, making the risk high for environments that expose ZoneMinder services to authenticated users. Prompt remediation is essential to prevent potential system compromise.