vendor:
Network Camera
by:
Or Peles, wvu, sinn3r, Brent Cook, Jacob Robles, Matthew Kienow, Shelby Pace, Chris Lee, Cale Black
9.8
CVSS
CRITICAL
Auth Bypass and Command Injection
78, 77, 94
CWE
Product Name: Network Camera
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE: CVE-2018-10660, CVE-2018-10661, CVE-2018-10662
CPE: None
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Unix
2018
Axis Network Camera .srv to parhand RCE
This module exploits an auth bypass in .srv functionality and a command injection in parhand to execute code as the root user.
Mitigation:
Axis has released a security advisory and a firmware update to address the vulnerabilities.
