Axis Network Camera and Video Server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker requests the serverreport.cgi script, which requires no authentication. This script will disclose various server events and information resulting in a loss of confidentiality.
Classification
Location:
Remote / Network Access
Attack Type:
Information Disclosure,
Misconfiguration
Impact:
Loss of Confidentiality
Exploit:
Exploit Public
OSVDB:
Web Related
Solution
Upgrade to firmware version 2.42 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: restrict remote access to administrative interface scripts.
wcd.se -
