PT-2013-4472 · Axis · Axis Media Control

Javier Repiso Sánchez · Published 2013-10-04 · Updated 2013-10-07 · CVE-2013-3543

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions AXIS Media Control (AMC) ActiveX control (AxisMediaControlEmb.dll) version 6.2.10.11

Description The issue allows remote attackers to create or overwrite arbitrary files. This can be achieved by providing a file path to certain methods, specifically the (1) StartRecord, (2) SaveCurrentImage, or (3) StartRecordMedia methods.

Recommendations For version 6.2.10.11, as a temporary workaround, consider restricting access to the StartRecord, SaveCurrentImage, and StartRecordMedia methods until a patch is available. Avoid using these methods with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-3543

Affected Products

Axis Media Control

References · 3

• 🔥 http://seclists.org/fulldisclosure/2013/Jun/84 · Exploit
• 🔥 https://exploit-db.com/exploits/26173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3543 · Security Note