high8.8Public exploit code
CVE-2015-8257
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- AXIS (Multiple Products) - 'devtools ' (Authenticated) Remote Command Execution2016-07-29 · webapps · linux
Impact
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Axis | Network Camera Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/138083/AXIS-Authenticated-Remote-Command-Execution.html
- http://www.securityfocus.com/bid/92159
- https://www.exploit-db.com/exploits/40171/
- http://packetstormsecurity.com/files/138083/AXIS-Authenticated-Remote-Command-Execution.html
- http://www.securityfocus.com/bid/92159
- https://www.exploit-db.com/exploits/40171/