PT-2018-18895 · Axis · Axis M1033-W

Published 2018-04-01 · Updated 2018-05-15 · CVE-2018-9158

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AXIS M1033-W (IP camera) Firmware version 5.40.5.1

Description The issue concerns a lack of a suitable mechanism to prevent a Denial of Service (DoS) attack, resulting in a response time delay. An attacker can exploit this by using the hping3 tool to perform an IPv4 flood attack, which interrupts services for the duration of the attack.

Recommendations For AXIS M1033-W (IP camera) Firmware version 5.40.5.1, consider implementing network traffic filtering to restrict incoming IPv4 flood attacks as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-9158

Affected Products

Axis M1033-W

References · 3

• 🔥 https://slideshare.net/secret/HpAEwK5qo5U4b1 · Exploit
• https://osv.dev/vulnerability/CVE-2018-9158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9158 · Security Note