Unscored severity · published Oct 4, 2007
CVE-2007-5212
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML via (1) parameters associated with saved settings, as demonstrated by the conf_SMTP_MailServer1 parameter to ServerManager.srv; or (2) the subpage parameter to wizard/first/wizard_main_first.shtml. NOTE: an attacker can leverage a CSRF vulnerability to modify saved settings.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2N
2100 Network Camera · Axis
2.02 · source: NVD
2N
2100 Network Camera Firmware · Axis
through 2.42 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5212
osvdb.org
http://osvdb.org/38795
osvdb.org
http://osvdb.org/38796
securityreason.com
http://securityreason.com/securityalert/3188
Exploit
http://www.procheckup.com/Vulnerability_Axis_2100_research.pdf
www.securityfocus.com
http://www.securityfocus.com/archive/1/480995/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/25837
More from 2100 Network Camera
–
CVE-2007-5214
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to inject arbitrary web script or…
–
CVE-2007-5213
Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to perform actions as…
–
CVE-2007-2239
Stack-based buffer overflow in the SaveBMP method in the AXIS Camera Control (aka CamImage) ActiveX control before 2.40.0.0 in AxisCamControl.ocx in AXIS 2100, 2110, 2120, 2130…
–
CVE-2004-2427
Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to obtain sensitive information via direct requests to (1) admin/getparam.cgi, (2)…
–
CVE-2004-0789
Multiple implementations of the DNS protocol, including (1) Poslib 1.0.2-1 and earlier as used by Posadis, (2) Axis Network products before firmware 3.13, and (3) Men & Mice Suite…