I was given CVE-2021-44255 for this – authenticated RCE via a malicious tasks (python pickle) file. So that’s fun. Even though it is authenticated, the default username is admin and the default password is blank, so you know how these things go. I actually haven’t heard of any MotionEye instances being used in botnets or anything.
I should probably request a CVE for the unauthenticated information disclosure that I found, but I need to do some more research on that one.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44255