NetSight
IP …
high7.5Public exploit code

CVE-2004-2425

Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly othe…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi.

Affected products

VendorProductAffected versions
Axis2100 Network Camera
Versions 2.12, 2.30, 2.31, 2.32, 2.33, 2.34
Axis2110 Network Camera
Versions 2.12, 2.30, 2.31, 2.32, 2.34, 2.40
Axis2120 Network Camera
Versions 2.12, 2.30, 2.31, 2.32, 2.34, 2.40
Axis2130 Ptz Network Camera
Versions 2.30, 2.31, 2.32, 2.34, 2.40
Axis230 Mpeg2 Video Server
Version 3.11
Axis2400 Video Server
Versions 1.1, 1.2, 1.10, 1.11, 1.12, 1.15
Axis2401 Video Server
Versions 1.0_1, 1.15, 2.20, 2.30, 2.31, 2.32
Axis2411 Video Server
Versions 3.12, 3.13
Axis2420 Network Camera
Versions 2.12, 2.30, 2.31, 2.32, 2.33, 2.34
Axis2420 Video Server
Versions 2.32, 2.34
Axis2460 Network Dvr
All versions
Versions 3.10, 3.11
Axis2490 Serial Server
All versions
Version 2.11.3

References