var-200412-0391
Vulnerability from variot
Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi. Multiple vulnerabilities are reported to reside in multiple Axis network video and camera servers: 1. A shell metacharacter command-execution vulnerability allows an anonymous user to download the contents of the '/etc/passwd' file on the device. Other commands are also likely to work, facilitating other attacks. This issue is reported to affect: - Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.34 thru 2.40 - Axis 2130 network cameras - Axis 2401 and 2401 video servers 2. A directory-traversal vulnerability in HTTP POST requests. This attack is demonstrated by an anonymous user calling protected administration scripts. This bypasses authentication checks and gives anonymous users remote adminitration of the devices. This issue is reported to affect: - Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.12 thru 2.40 - Axis 2130 network cameras - Axis 2401,and 2401 video servers 3. A hardcoded backdoor administrative-user issue allows remote attackers to administer affected devices. This likely cannot be disabled. This issue is reported to affect: - Axis StorePoint CD E100 CD-ROM Server with firmware version 5.30 Other products and versions of firmware are likely affected by one or more of these vulnerabilities
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-200412-0391", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "2490 serial server", "scope": "eq", "trust": 1.6, "vendor": "axis", "version": "2.11.3" }, { "model": "2460 network dvr", "scope": "eq", "trust": 1.6, "vendor": "axis", "version": "3.11" }, { "model": "250s video server", "scope": "eq", "trust": 1.6, "vendor": "axis", "version": "3.03" }, { "model": "2460 network dvr", "scope": "eq", "trust": 1.6, "vendor": "axis", "version": "3.10" }, { "model": "2420 video server", "scope": "eq", "trust": 1.6, "vendor": "axis", "version": "2.34" }, { "model": "250s video server", "scope": "eq", "trust": 1.6, "vendor": "axis", "version": "3.10" }, { "model": "2460 network dvr", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "*" }, { "model": "2420 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.31" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.30" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.32" }, { "model": "2420 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.40" }, { "model": "2110 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.40" }, { "model": "2120 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.41" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.33" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "1.15" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "1.12" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.31" }, { "model": "2130 ptz network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.31" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "1.1" }, { "model": "2100 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.34" }, { "model": "2411 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "3.13" }, { "model": "2100 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.12" }, { "model": "2130 ptz network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.40" }, { "model": "250s video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "*" }, { "model": "2420 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.32" }, { "model": "2110 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.34" }, { "model": "2120 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.31" }, { "model": "2411 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "3.12" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.33" }, { "model": "2110 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.12" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "1.0_1" }, { "model": "2420 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.12" }, { "model": "2420 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.34" }, { "model": "2120 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.40" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.20" }, { "model": "storpoint cd", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "*" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "3.12" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "1.2" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "1.15" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.31" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.34" }, { "model": "2130 ptz network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.34" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "1.11" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "3.13" }, { "model": "2120 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.12" }, { "model": "2120 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.34" }, { "model": "2100 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.32" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "3.12" }, { "model": "2100 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.30" }, { "model": "2490 serial server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "*" }, { "model": "2401 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.34" }, { "model": "2110 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.32" }, { "model": "2420 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.30" }, { "model": "2420 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.32" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.20" }, { "model": "2110 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.30" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "1.10" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "3.11" }, { "model": "2100 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.41" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.0" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.30" }, { "model": "2400 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.32" }, { "model": "2130 ptz network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.30" }, { "model": "2130 ptz network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.32" }, { "model": "2100 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.33" }, { "model": "2110 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.41" }, { "model": "230 mpeg2 video server", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "3.11" }, { "model": "2420 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.41" }, { "model": "2100 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.31" }, { "model": "2420 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.33" }, { "model": "2100 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.40" }, { "model": "2120 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.30" }, { "model": "2120 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.32" }, { "model": "2110 network camera", "scope": "eq", "trust": 1.0, "vendor": "axis", "version": "2.31" }, { "model": "250s video server", "scope": null, "trust": 0.6, "vendor": "axis", "version": null }, { "model": "2490 serial server", "scope": null, "trust": 0.6, "vendor": "axis", "version": null }, { "model": "2460 network dvr", "scope": null, "trust": 0.6, "vendor": "axis", "version": null }, { "model": "storpoint cd", "scope": null, "trust": 0.6, "vendor": "axis", "version": null }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24002.31" }, { "model": "communications video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "2401+3.13" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.32" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21002.40" }, { "model": "communications ptz network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21302.40" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21002.31" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21002.34" }, { "model": "communications 250s mpeg-2 video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "3.20" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24001.02" }, { "model": "communications ptz network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21302.31" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24002.32" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24001.15" }, { "model": "communications video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "24012.34.1" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21002.32" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21002.30" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24012.32" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.32" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21202.30" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24113.12" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21202.32" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24002.33" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21202.31" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2400+3.12" }, { "model": "communications network camera", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "24202.42" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21102.32" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.41" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24002.20" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2401+3.13" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24012.20" }, { "model": "communications ptz network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21302.34" }, { "model": "communications network dvr", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2460" }, { "model": "communications video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "24113.13" }, { "model": "communications network camera", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "21302.42" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.12" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21202.34" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24002.30" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21002.41" }, { "model": "communications video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "2400+3.13" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24002.34" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.33" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24012.31" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24002.0" }, { "model": "communications 250s mpeg-2 video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "3.10" }, { "model": "communications serial server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2490" }, { "model": "communications ptz network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21302.32" }, { "model": "communications mpeg-2 video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "2303.20" }, { "model": "communications 250s video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "3.03" }, { "model": "communications blade video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "2401+3.13" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21002.12" }, { "model": "communications network camera", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "21202.42" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24001.12" }, { "model": "communications network camera", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "21002.42" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24011.01" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2400+3.11" }, { "model": "communications video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "24002.34.1" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24012.33" }, { "model": "communications network dvr", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24603.10" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21202.12" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24113.13" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21202.40" }, { "model": "communications network dvr", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24603.11" }, { "model": "communications mpeg-2 video server 250s", "scope": null, "trust": 0.3, "vendor": "axis", "version": null }, { "model": "communications storpoint cd", "scope": null, "trust": 0.3, "vendor": "axis", "version": null }, { "model": "communications serial server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24902.11.3" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24012.34" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24001.10" }, { "model": "communications blade video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2400+3.12" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21102.41" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.34" }, { "model": "communications network camera", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "21102.42" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.40" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2401+3.12" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24001.11" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24011.15" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21002.33" }, { "model": "communications blade video server", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "2400+3.13" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.34" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.31" }, { "model": "communications ptz network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21302.30" }, { "model": "communications digital video recorder", "scope": "ne", "trust": 0.3, "vendor": "axis", "version": "24603.13" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24001.01" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21102.12" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21102.34" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21102.30" }, { "model": "communications video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24012.30" }, { "model": "communications mpeg-2 video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2303.11" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21202.41" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21102.40" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "21102.31" }, { "model": "communications network camera", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "24202.30" }, { "model": "communications blade video server", "scope": "eq", "trust": 0.3, "vendor": "axis", "version": "2401+3.12" } ], "sources": [ { "db": "BID", "id": "11011" }, { "db": "NVD", "id": "CVE-2004-2425" }, { "db": "CNNVD", "id": "CNNVD-200412-1131" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:axis:2100_network_camera:2.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2100_network_camera:2.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2110_network_camera:2.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2110_network_camera:2.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2110_network_camera:2.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2120_network_camera:2.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2120_network_camera:2.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2130_ptz_network_camera:2.40:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2100_network_camera:2.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2100_network_camera:2.41:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2110_network_camera:2.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2120_network_camera:2.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2120_network_camera:2.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2130_ptz_network_camera:2.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2130_ptz_network_camera:2.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:1.15:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:3.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:3.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:2.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:2.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_network_camera:2.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_network_camera:2.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_network_camera:2.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2460_network_dvr:3.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2460_network_dvr:3.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2100_network_camera:2.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2100_network_camera:2.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2110_network_camera:2.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2110_network_camera:2.40:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2120_network_camera:2.40:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2120_network_camera:2.41:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:1.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:2.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:2.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:2.20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:2.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2411_video_server:3.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2411_video_server:3.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_network_camera:2.41:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_video_server:2.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:250s_video_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:250s_video_server:3.03:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:230_mpeg2_video_server:3.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:2.20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:2.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:1.0_1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:1.15:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:3.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:3.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_network_camera:2.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_network_camera:2.40:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2490_serial_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2490_serial_server:2.11.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2100_network_camera:2.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2100_network_camera:2.40:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2110_network_camera:2.41:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2120_network_camera:2.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2130_ptz_network_camera:2.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2130_ptz_network_camera:2.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:1.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:1.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:2.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2400_video_server:2.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:2.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2401_video_server:2.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_network_camera:2.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_network_camera:2.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2420_video_server:2.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:2460_network_dvr:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:250s_video_server:3.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:h:axis:storpoint_cd:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2004-2425" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "bashis", "sources": [ { "db": "CNNVD", "id": "CNNVD-200412-1131" } ], "trust": 0.6 }, "cve": "CVE-2004-2425", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "impactScore": 6.4, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "id": "VHN-10853", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "NVD", "id": "CVE-2004-2425", "trust": 1.0, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-200412-1131", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-10853", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-10853" }, { "db": "NVD", "id": "CVE-2004-2425" }, { "db": "CNNVD", "id": "CNNVD-200412-1131" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi. Multiple vulnerabilities are reported to reside in multiple Axis network video and camera servers:\n1. A shell metacharacter command-execution vulnerability allows an anonymous user to download the contents of the \u0027/etc/passwd\u0027 file on the device. Other commands are also likely to work, facilitating other attacks. \nThis issue is reported to affect:\n- Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.34 thru 2.40\n- Axis 2130 network cameras\n- Axis 2401 and 2401 video servers\n2. A directory-traversal vulnerability in HTTP POST requests. This attack is demonstrated by an anonymous user calling protected administration scripts. This bypasses authentication checks and gives anonymous users remote adminitration of the devices. \nThis issue is reported to affect:\n- Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.12 thru 2.40\n- Axis 2130 network cameras\n- Axis 2401,and 2401 video servers\n3. A hardcoded backdoor administrative-user issue allows remote attackers to administer affected devices. This likely cannot be disabled. \nThis issue is reported to affect:\n- Axis StorePoint CD E100 CD-ROM Server with firmware version 5.30\nOther products and versions of firmware are likely affected by one or more of these vulnerabilities", "sources": [ { "db": "NVD", "id": "CVE-2004-2425" }, { "db": "BID", "id": "11011" }, { "db": "VULHUB", "id": "VHN-10853" } ], "trust": 1.26 }, "exploit_availability": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "reference": "https://www.scap.org.cn/vuln/vhn-10853", "trust": 0.1, "type": "unknown" } ], "sources": [ { "db": "VULHUB", "id": "VHN-10853" } ] }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "BID", "id": "11011", "trust": 2.0 }, { "db": "SECTRACK", "id": "1011056", "trust": 1.7 }, { "db": "SECUNIA", "id": "12353", "trust": 1.7 }, { "db": "OSVDB", "id": "9121", "trust": 1.7 }, { "db": "NVD", "id": "CVE-2004-2425", "trust": 1.7 }, { "db": "CNNVD", "id": "CNNVD-200412-1131", "trust": 0.7 }, { "db": "FULLDISC", "id": "20040831 AXIS NETWORK CAMERA AND VIDEO SERVER SECURITY ADVISORY", "trust": 0.6 }, { "db": "FULLDISC", "id": "20040822 [POC] NASTY BUG(S) FOUND IN AXIS NETWORK CAMERA/VIDEO SERVERS", "trust": 0.6 }, { "db": "XF", "id": "17076", "trust": 0.6 }, { "db": "EXPLOIT-DB", "id": "24400", "trust": 0.1 }, { "db": "SEEBUG", "id": "SSVID-78132", "trust": 0.1 }, { "db": "VULHUB", "id": "VHN-10853", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-10853" }, { "db": "BID", "id": "11011" }, { "db": "NVD", "id": "CVE-2004-2425" }, { "db": "CNNVD", "id": "CNNVD-200412-1131" } ] }, "id": "VAR-200412-0391", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-10853" } ], "trust": 0.54047618 }, "last_update_date": "2023-12-18T12:47:25.318000Z", "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "NVD-CWE-Other", "trust": 1.0 } ], "sources": [ { "db": "NVD", "id": "CVE-2004-2425" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "http://www.securityfocus.com/bid/11011" }, { "trust": 1.7, "url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0948.html" }, { "trust": 1.7, "url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-08/1282.html" }, { "trust": 1.7, "url": "http://www.osvdb.org/9121" }, { "trust": 1.7, "url": "http://securitytracker.com/id?1011056" }, { "trust": 1.7, "url": "http://secunia.com/advisories/12353" }, { "trust": 1.1, "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17076" }, { "trust": 0.6, "url": "http://xforce.iss.net/xforce/xfdb/17076" }, { "trust": 0.3, "url": "http://www.axis.com/products/camera_servers/index.htm" }, { "trust": 0.3, "url": "/archive/1/372643" }, { "trust": 0.3, "url": "/archive/1/372630" } ], "sources": [ { "db": "VULHUB", "id": "VHN-10853" }, { "db": "BID", "id": "11011" }, { "db": "NVD", "id": "CVE-2004-2425" }, { "db": "CNNVD", "id": "CNNVD-200412-1131" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-10853" }, { "db": "BID", "id": "11011" }, { "db": "NVD", "id": "CVE-2004-2425" }, { "db": "CNNVD", "id": "CNNVD-200412-1131" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2004-12-31T00:00:00", "db": "VULHUB", "id": "VHN-10853" }, { "date": "2004-08-23T00:00:00", "db": "BID", "id": "11011" }, { "date": "2004-12-31T05:00:00", "db": "NVD", "id": "CVE-2004-2425" }, { "date": "2004-12-31T00:00:00", "db": "CNNVD", "id": "CNNVD-200412-1131" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-07-11T00:00:00", "db": "VULHUB", "id": "VHN-10853" }, { "date": "2007-02-06T20:08:00", "db": "BID", "id": "11011" }, { "date": "2017-07-11T01:31:53.107000", "db": "NVD", "id": "CVE-2004-2425" }, { "date": "2005-10-20T00:00:00", "db": "CNNVD", "id": "CNNVD-200412-1131" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-200412-1131" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Axis Network Camera And Video Server Multiple Vulnerabilities", "sources": [ { "db": "BID", "id": "11011" }, { "db": "CNNVD", "id": "CNNVD-200412-1131" } ], "trust": 0.9 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Design Error", "sources": [ { "db": "BID", "id": "11011" }, { "db": "CNNVD", "id": "CNNVD-200412-1131" } ], "trust": 0.9 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.