Unscored severity · published Dec 31, 2004
CVE-2004-2426
Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication via a
–
CVSS
4.2%
EPSS
No
On KEV
Description
Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication via a .. (dot dot) in an HTTP POST request to ServerManager.srv, then use these privileges to conduct other activities, such as modifying files using editcgi.cgi.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2N
2100 Network Camera · Axis
2.12; 2.30; 2.31; 2.32; 2.33; 2.34; +2 more · source: NVD
2N
2110 Network Camera · Axis
2.12; 2.30; 2.31; 2.32; 2.34; 2.40; +1 more · source: NVD
2N
2120 Network Camera · Axis
2.12; 2.30; 2.31; 2.32; 2.34; 2.40; +1 more · source: NVD
2P
2130 Ptz Network Camera · Axis
2.30; 2.31; 2.32; 2.34; 2.40 · source: NVD
2M
230 Mpeg2 Video Server · Axis
3.11 · source: NVD
2V
2400 Video Server · Axis
1.1; 1.2; 1.10; 1.11; 1.12; 1.15; +9 more · source: NVD
2V
2401 Video Server · Axis
1.0_1; 1.15; 2.20; 2.30; 2.31; 2.32; +4 more · source: NVD
2V
2411 Video Server · Axis
3.12; 3.13 · source: NVD
2N
2420 Network Camera · Axis
2.12; 2.30; 2.31; 2.32; 2.33; 2.34; +2 more · source: NVD
2V
2420 Video Server · Axis
2.32; 2.34 · source: NVD
2N
2460 Network Dvr · Axis
3.10; 3.11 · source: NVD
2S
2490 Serial Server · Axis
2.11.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2426
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2426
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0948.html
Patch
http://archives.neohapsis.com/archives/fulldisclosure/2004-08/1282.html
Patch
http://secunia.com/advisories/12353
Exploit
http://securitytracker.com/id?1011056
www.osvdb.org
http://www.osvdb.org/9122
Patch
http://www.securityfocus.com/bid/11011
More from 2100 Network Camera
–
CVE-2007-5214
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to inject arbitrary web script or…
–
CVE-2007-5213
Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to perform actions as…
–
CVE-2007-5212
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML…
–
CVE-2007-2239
Stack-based buffer overflow in the SaveBMP method in the AXIS Camera Control (aka CamImage) ActiveX control before 2.40.0.0 in AxisCamControl.ocx in AXIS 2100, 2110, 2120, 2130…
–
CVE-2004-2427
Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to obtain sensitive information via direct requests to (1) admin/getparam.cgi, (2)…