SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2004-2427

Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to obtain sensitive information via direct requests to (1) admin/getparam.cgi, (2) admin/systemlog.cgi, (3) admin/serverreport.cgi, and (4)…

HIGH 10.0EPSS 5.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to obtain sensitive information via direct requests to (1) admin/getparam.cgi, (2) admin/systemlog.cgi, (3) admin/serverreport.cgi, and (4) admin/paramlist.cgi, modify system information via (5) setparam.cgi and (6) factorydefault.cgi, or (7) cause a denial of service (reboot) via restart.cgi.

CVSS 2.0
10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
5.37% probability · 92th percentile
CISA KEV
Not listed
Affected
axis/2100 network camera · axis/2110 network camera · axis/2120 network camera · axis/2130 ptz network camera · axis/230 mpeg2 video server · axis/2400 video server · axis/2401 video server · axis/2411 video server · axis/2420 network camera · axis/2420 video server · axis/2460 network dvr · axis/2490 serial server · axis/250s video server · axis/storpoint cd
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.