Seth Fogie has reported some vulnerabilities in the AXIS 207W Network Camera, which can be exploited by malicious people to conduct cross-site scripting and cross-site request forgery attacks, or by malicious users to cause a DoS (Denial of Service).

1) Input passed to the "camNo" parameter in incl/image_incl.shtml is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) The web interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. reboot the camera, add a new administrator, or to install a backdoor by enticing a logged-in administrator to visit a malicious site.

3) An unspecified vulnerability exists within the axis-cgi/buffer/command.cgi script. This can be exploited to reboot the vulnerable system by issuing multiple HTTP requests (more than 129) for the affected script with the "do" parameter set to "start" and with an arbitrary value for the "buffername" parameter.

Successful exploitation of this vulnerability requires valid user credentials.

Solution
Filter traffic to affected devices and do not visit untrusted web sites while being logged in to the device.

Provided and/or discovered by
Seth Fogie, Airscanner Mobile Security

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://airscanner.com/security/07080701_axis.htm

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers