CVE-2003-0240 The web-based administration capability for various Axis Network Camera products allows remote attackers to bypass access restrictions and modify configuration via an HTTP request to the admin/admin.s...
HighCVSS 10.0
EPSS 29.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The web-based administration capability for various Axis Network Camera products allows remote attackers to bypass access restrictions and modify configuration via an HTTP request to the admin/admin.shtml containing a leading // (double slash).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| axis 2100 network camera | <= 2.32 | No fix listed |
| axis 2110 network camera | <= 2.32 | No fix listed |
| axis 2120 network camera | <= 2.32 | No fix listed |
| axis 2130 ptz network camera | <= 2.32 | No fix listed |
| axis 2400 video server | <= 2.32 | No fix listed |
| axis 2401 video server | <= 2.32 | No fix listed |
| axis 2420 network camera | <= 2.32 | No fix listed |
| axis 2460 network dvr | <= 3.00 | No fix listed |
| axis 250s video server | <= 3.02 | No fix listed |
References
- 20030527 CORE-2003-0403: Axis Network Camera HTTP Authentication Bypass mailing-list
- 8876 third-party-advisory
- 1006854 vdb-entry
- www.coresecurity.com
- VU#799060 third-party-advisory us-government-resource
- 4804 vdb-entry
- 7652 vdb-entry
- axis-admin-authentication-bypass(12104) vdb-entry