|
Axis Network Camera HTTP Authentication Bypass Vulnerability
|
|
Secunia Advisory:
|
SA8876
|
|
|
Release Date:
|
2003-05-28
|
|
Last Update:
|
2004-11-30
|
|
Popularity:
|
13,446 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Axis Network Camera
Axis Network DVR
Axis Network Video Server
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
A vulnerability has been identified in several Axis Network Cameras, which can be exploited by a malicious person to bypass user authentication.
Normally a user is required to input a username and password before access is granted to "http://[victim]/admin/admin.shtml". However, by sending a HTTP request with an extra "/" before the "admin" folder, it is possible to bypass the authentication completely.
Example:
http://[victim]//admin/admin.shtml
This method can also be exploited to gain access to other administrative pages.
The following products have been reported vulnerable:
- AXIS 2100 Network Camera versions 2.32 and previous
- AXIS 2110 Network Camera versions 2.32 and previous
- AXIS 2120 Network Camera versions 2.32 and previous
- AXIS 2130 PTZ Network Camera versions 2.32 and previous
- AXIS 2400 Video Server versions 2.32 and previous
- AXIS 2401 Video Server versions 2.32 and previous
- AXIS 2420 Network Camera versions 2.32 and previous
- AXIS 2460 Network DVR versions 3.00 and previous
- AXIS 250S Video Server versions 3.02 and previous
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
