Secunia

bashis has reported two vulnerabilities in Axis Network Camera / Video Server, which potentially can be exploited by malicious people to compromise a vulnerable system and gain knowledge of sensitive information.

1) An input validation error in the script "/axis-cgi/io/virtualinput.cgi" allows injection of arbitrary shell commands.

bashi has posted an PoC, which retrieves the local password file.

2) A directory traversal vulnerability makes it possible to bypass user authentication and access "ServerManager.srv", which e.g. makes it possible to add additional users.

Example:
POST /cgi-bin/scripts/../../[this_server]/ServerManager.srv HTTP/1.0
[content]

bashi has posted an PoC, which creates a new administrator account.

The vulnerabilities reportedly affect:
* Axis 2100 / 2110 / 2120 / 2420 / 2130 Network Camera.
* 2400 / 2401 Video Server.

Solution
Updated firmware releases are available.
Further details available in Customer Area

Provided and/or discovered by
bashis

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area