PT-2007-6295 · Axis · Axis 2100 Network Camera

Published 2007-10-04 · Updated 2018-10-15 · CVE-2007-5212

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AXIS 2100 Network Camera version 2.02 with firmware before 2.43

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via parameters associated with saved settings, such as the conf SMTP MailServer1 parameter to "ServerManager.srv", or the subpage parameter to "wizard/first/wizard main first.shtml". Additionally, an attacker can exploit a CSRF vulnerability to modify saved settings.

Recommendations For AXIS 2100 Network Camera version 2.02 with firmware before 2.43, update the firmware to version 2.43 or later to resolve the issue. As a temporary workaround, consider restricting access to the "ServerManager.srv" and "wizard/first/wizard main first.shtml" endpoints to minimize the risk of exploitation. Avoid using the conf SMTP MailServer1 and subpage parameters in the affected endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-5212

Affected Products

Axis 2100 Network Camera

References · 8

• 🔥 http://procheckup.com/Vulnerability_Axis_2100_research.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5212 · Security Note
• http://osvdb.org/38796 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5212 · Note
• http://securityfocus.com/bid/25837 · Note
• http://osvdb.org/38795 · Note
• http://securityreason.com/securityalert/3188 · Note
• http://securityfocus.com/archive/1/480995/100/0/threaded · Note