Quantum Secular Labs / Blog / Advisories

CVE-2003-0240: The web-based administration capability for various Axis Network Camera products allows remote attackers to…

CVE-2003-0240 has a CVSS v2 base score of 10.0 (the maximum on that scale) and NVD lists 9 affected products, including Axis 2100 Network Camera. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

The web-based administration capability for various Axis Network Camera products allows remote attackers to bypass access restrictions and modify configuration via an HTTP request to the admin/admin.shtml containing a leading // (double slash).

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Axis 2100 Network Camera: up to and including 2.32
  • Axis 2110 Network Camera: up to and including 2.32
  • Axis 2120 Network Camera: up to and including 2.32
  • Axis 2130 Ptz Network Camera: up to and including 2.32
  • Axis 2400 Video Server: up to and including 2.32
  • Axis 2401 Video Server: up to and including 2.32
  • Axis 2420 Network Camera: up to and including 2.32
  • Axis 2460 Network Dvr: up to and including 3.00
  • Axis 250s Video Server: up to and including 3.02

References