vendor:
Camera
by:
bashis
8,8
CVSS
HIGH
Remote Code Execution and File Read
78
CWE
Product Name: Camera
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2016
SSI Remote Execute and Read Files
This vulnerability allows an attacker to execute remote commands and read remote files on an Axis camera. The attacker must first configure the camera to allow anonymous view. To execute remote commands, the attacker must send a GET request with a command encoded in the URL. To read remote files, the attacker must send a GET request with the file path encoded in the URL. Both requests must be sent to the target IP and port.
Mitigation:
The camera must be configured to not allow anonymous view.
