PT-2007-6295 · Axis · Axis 2100 Network Camera

Publicado 2007-10-04 · Atualizado 2018-10-15 · CVE-2007-5212

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AXIS 2100 Network Camera version 2.02 with firmware before 2.43

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via parameters associated with saved settings, such as the conf SMTP MailServer1 parameter to "ServerManager.srv", or the subpage parameter to "wizard/first/wizard main first.shtml". Additionally, an attacker can exploit a CSRF vulnerability to modify saved settings.

Recommendations For AXIS 2100 Network Camera version 2.02 with firmware before 2.43, update the firmware to version 2.43 or later to resolve the issue. As a temporary workaround, consider restricting access to the "ServerManager.srv" and "wizard/first/wizard main first.shtml" endpoints to minimize the risk of exploitation. Avoid using the conf SMTP MailServer1 and subpage parameters in the affected endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5212

Produtos afetados

Axis 2100 Network Camera

Referências · 8

• 🔥 http://procheckup.com/Vulnerability_Axis_2100_research.pdf · Exploit
• http://osvdb.org/38796 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5212 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5212 · Nota
• http://securityfocus.com/bid/25837 · Nota
• http://osvdb.org/38795 · Nota
• http://securityreason.com/securityalert/3188 · Nota
• http://securityfocus.com/archive/1/480995/100/0/threaded · Nota