PT-2007-6296 · Axis · Axis 2100 Network Camera

Publicado 2007-10-04 · Atualizado 2018-10-15 · CVE-2007-5213

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AXIS 2100 Network Camera versions 2.02 with firmware 2.43 and earlier

Description The issue allows remote attackers to perform actions as administrators due to multiple cross-site request forgery (CSRF) vulnerabilities. This can be demonstrated by changing the SMTP server through the conf SMTP MailServer1 parameter to ServerManager.srv or by changing the hostname through the conf Network HostName parameter on the Network page.

Recommendations For AXIS 2100 Network Camera versions 2.02 with firmware 2.43 and earlier, consider disabling access to the ServerManager.srv and the Network page until a patch is available to prevent exploitation of the CSRF vulnerabilities. Restrict access to the conf SMTP MailServer1 and conf Network HostName parameters to minimize the risk of unauthorized changes.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2007-5213

Produtos afetados

Axis 2100 Network Camera

Referências · 8

• 🔥 http://procheckup.com/Vulnerability_Axis_2100_research.pdf · Exploit
• http://osvdb.org/39491 · Nota
• http://osvdb.org/39490 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5213 · Nota de Segurança
• http://securityfocus.com/bid/25837 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5213 · Nota
• http://securityreason.com/securityalert/3188 · Nota
• http://securityfocus.com/archive/1/480995/100/0/threaded · Nota