Axis Network Camera and Video Server contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the virtualinput.cgi script not requiring authentication and not properly sanitizing user supplied input. By sending a specially crafted URL, an attacker can use this script to inject arbitrary commands which will be executed by the server.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation,
Misconfiguration
Impact:
Loss of Integrity
Exploit:
Exploit Public
OSVDB:
Web Related
Solution
Upgrade to firmware version 2.42 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: restrict remote access to administrative interface scripts.
wcd.se -
