Axis Network Camera HTTP Authentication Bypass Vulnerability
BID:7652
Info
Axis Network Camera HTTP Authentication Bypass Vulnerability
| Bugtraq ID: | 7652 |
| Class: | Access Validation Error |
| CVE: |
CVE-2003-0240 |
| Remote: | Yes |
| Local: | No |
| Published: | May 27 2003 12:00AM |
| Updated: | Jul 11 2009 10:06PM |
| Credit: | The discovery of this vulnerability has been credited to Juliano Rizzo of Core Security Technologies. |
| Vulnerable: |
Axis Communications 2420 Video Server 2.32 Axis Communications 2420 Network Camera 2.32 Axis Communications 2420 Network Camera 2.31 Axis Communications 2420 Network Camera 2.30 Axis Communications 2401 Video Server 2.32 Axis Communications 2401 Video Server 2.32 Axis Communications 2401 Video Server 2.31 Axis Communications 2401 Video Server 2.30 Axis Communications 2400 Video Server 2.32 Axis Communications 2400 Video Server 2.31 Axis Communications 2400 Video Server 2.30 Axis Communications 2130 PTZ Network Camera 2.32 Axis Communications 2130 PTZ Network Camera 2.31 Axis Communications 2130 PTZ Network Camera 2.30 Axis Communications 2120 Network Camera 2.32 Axis Communications 2120 Network Camera 2.31 Axis Communications 2120 Network Camera 2.30 Axis Communications 2110 Network Camera 2.32 Axis Communications 2110 Network Camera 2.31 Axis Communications 2110 Network Camera 2.30 Axis Communications 2100 Network Camera 2.32 Axis Communications 2100 Network Camera 2.31 Axis Communications 2100 Network Camera 2.30 |
| Not Vulnerable: |
Axis Communications 250S Video Server 3.0 3 Axis Communications 2460 Network DVR 3.10 Axis Communications 2420 Network Camera 2.34 Axis Communications 2401 Video Server 2.34 Axis Communications 2400 Video Server 2.34 Axis Communications 2130 PTZ Network Camera 2.34 Axis Communications 2120 Network Camera 2.34 Axis Communications 2110 Network Camera 2.34 Axis Communications 2100 Network Camera 2.34 |
Discussion
Axis Network Camera HTTP Authentication Bypass Vulnerability
A vulnerability has been discovered in various Axis Communications products. By making a request for a specially formatted URL, it may be possible for remote users to access the administrative configuration interface without being prompted for authentication.
A vulnerability has been discovered in various Axis Communications products. By making a request for a specially formatted URL, it may be possible for remote users to access the administrative configuration interface without being prompted for authentication.
Exploit / POC
Axis Network Camera HTTP Authentication Bypass Vulnerability
No exploit required. The following proof of concept URL has been provided to demonstrate this issue:
http://camera-ip//admin/admin.shtml
No exploit required. The following proof of concept URL has been provided to demonstrate this issue:
http://camera-ip//admin/admin.shtml