PT-2007-6296 · Axis · Axis 2100 Network Camera

Published 2007-10-04 · Updated 2018-10-15 · CVE-2007-5213

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AXIS 2100 Network Camera versions 2.02 with firmware 2.43 and earlier

Description The issue allows remote attackers to perform actions as administrators due to multiple cross-site request forgery (CSRF) vulnerabilities. This can be demonstrated by changing the SMTP server through the conf SMTP MailServer1 parameter to ServerManager.srv or by changing the hostname through the conf Network HostName parameter on the Network page.

Recommendations For AXIS 2100 Network Camera versions 2.02 with firmware 2.43 and earlier, consider disabling access to the ServerManager.srv and the Network page until a patch is available to prevent exploitation of the CSRF vulnerabilities. Restrict access to the conf SMTP MailServer1 and conf Network HostName parameters to minimize the risk of unauthorized changes.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-5213

Affected Products

Axis 2100 Network Camera

References · 8

• 🔥 http://procheckup.com/Vulnerability_Axis_2100_research.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5213 · Security Note
• http://osvdb.org/39491 · Note
• http://osvdb.org/39490 · Note
• http://securityfocus.com/bid/25837 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5213 · Note
• http://securityreason.com/securityalert/3188 · Note
• http://securityfocus.com/archive/1/480995/100/0/threaded · Note