NetSight
IP …
medium5.0

CVE-2004-2426

Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication …

Impact

Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication via a .. (dot dot) in an HTTP POST request to ServerManager.srv, then use these privileges to conduct other activities, such as modifying files using editcgi.cgi.

Affected products

VendorProductAffected versions
Axis2100 Network Camera
Versions 2.12, 2.30, 2.31, 2.32, 2.33, 2.34
Axis2110 Network Camera
Versions 2.12, 2.30, 2.31, 2.32, 2.34, 2.40
Axis2120 Network Camera
Versions 2.12, 2.30, 2.31, 2.32, 2.34, 2.40
Axis2130 Ptz Network Camera
Versions 2.30, 2.31, 2.32, 2.34, 2.40
Axis230 Mpeg2 Video Server
Version 3.11
Axis2400 Video Server
Versions 1.1, 1.2, 1.10, 1.11, 1.12, 1.15
Axis2401 Video Server
Versions 1.0_1, 1.15, 2.20, 2.30, 2.31, 2.32
Axis2411 Video Server
Versions 3.12, 3.13
Axis2420 Network Camera
Versions 2.12, 2.30, 2.31, 2.32, 2.33, 2.34
Axis2420 Video Server
Versions 2.32, 2.34
Axis2460 Network Dvr
All versions
Versions 3.10, 3.11
Axis2490 Serial Server
All versions
Version 2.11.3

References