Axis Network Camera Default Administrator Password Vulnerability

Bugtraq ID:	3640
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 05 2001 12:00AM
Updated:	Dec 05 2001 12:00AM
Credit:	Discovered by Chris Gragsone ([email protected]) of the Foot Clan, and published in an advisory dated December 5, 2001.
Vulnerable:	Axis Communications Network Camera 2120 Axis Communications Network Camera 2110 Axis Communications Network Camera 2100 Axis Communications Network Camera 200+ Axis Communications Network Camera 200
Not Vulnerable:

Axis Network Camera Default Administrator Password Vulnerability

Axis Network Cameras are network ready cameras, including an internal web server to display images. They also include a web based administration tool.

By default, the password to administer the cameras is 'pass'. This allows an attacker who knows the address of a camera using the default password to trivially gain full access, and alter the configuration of the camera.

Axis Network Camera Default Administrator Password Vulnerability

No exploit code is required to take advantage of this issue.

Axis Network Camera Default Administrator Password Vulnerability

Solution:
To prevent this problem, change the administrator password.

Axis Network Camera Default Administrator Password Vulnerability

References:

• Network Camera and Video Servers (Axis Communications)