CVE-2004-2427: Critical severity axis 2120 network camera vulnerability

Published Dec 31, 2004

Updated

Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to obtain sensitive information via direct requests to (1) admin/getparam.cgi, (2) admin/systemlog.cgi, (3) admin/serverreport.cgi, and (4) admin/paramlist.cgi, modify system information via (5) setparam.cgi and (6) factorydefault.cgi, or (7) cause a denial of service (reboot) via restart.cgi.

Affected Software

74 affected components

Axis 2120 Network Camera=2.31

Axis 2110 Network Camera=2.32

Axis StorPoint CD

Axis 2100 Network Camera=2.12

Axis 2400 Video Server=1.15

Axis 2100 Network Camera=2.41

Axis 2400 Video Server=2.20

Axis 2411 Video Server=3.13

Axis 2120 Network Camera=2.32

Axis 2400 Video Server=3.12

Axis 2110 Network Camera=2.41

Axis 2420 Network Camera=2.33

Axis 2420 Network Camera=2.12

Axis 2120 Network Camera=2.34

Axis 2100 Network Camera=2.31

Axis 2110 Network Camera=2.12

Axis 2420 Video Server=2.34

Axis 2120 Network Camera=2.30

Axis 2420 Video Server=2.32

Axis 2130 Ptz Network Camera=2.32

Axis 2401 Video Server=1.0_1

Axis 2420 Network Camera=2.30

Axis 2401 Video Server=1.15

Axis 2401 Video Server=3.13

Axis 2120 Network Camera=2.12

Axis 2460 Network Dvr=3.10

Axis 230 Mpeg2 Video Server=3.11

Axis 2401 Video Server=2.33

Axis 2400 Video Server=1.12

Axis 2100 Network Camera=2.30

Axis 2130 Ptz Network Camera=2.30

Axis 2420 Network Camera=2.32

Axis 2400 Video Server=2.31

Axis 2110 Network Camera=2.34

Axis 2490 Serial Server=2.11.3

Axis 2401 Video Server=2.20

Axis 2400 Video Server=2.30

Axis 2130 Ptz Network Camera=2.34

Axis 250s Video Server=3.10

Axis 2120 Network Camera=2.41

Axis 2420 Network Camera=2.40

Axis 2490 Serial Server

Axis 2401 Video Server=2.34

Axis 2130 Ptz Network Camera=2.31

Axis 250s Video Server

Axis 2401 Video Server=2.30

Axis 2400 Video Server=1.1

Axis 2401 Video Server=2.31

Axis 2120 Network Camera=2.40

Axis 2400 Video Server=2.34

Axis 2130 Ptz Network Camera=2.40

Axis 2100 Network Camera=2.33

Axis 250s Video Server=3.03

Axis 2110 Network Camera=2.30

Axis 2110 Network Camera=2.31

Axis 2400 Video Server=2.33

Axis 2401 Video Server=3.12

Axis 2401 Video Server=2.32

Axis 2420 Network Camera=2.41

Axis 2400 Video Server=1.10

Axis 2460 Network Dvr

Axis 2400 Video Server=2.32

Axis 2400 Video Server=1.11

Axis 2100 Network Camera=2.40

Axis 2100 Network Camera=2.32

Axis 2110 Network Camera=2.40

Axis 2400 Video Server=3.11

Axis 2411 Video Server=3.12

Axis 2460 Network Dvr=3.11

Axis 2100 Network Camera=2.34

Axis 2400 Video Server=2.0

Axis 2400 Video Server=1.2

Axis 2420 Network Camera=2.31

Axis 2420 Network Camera=2.34

Remediation

Patch Available

http://www.osvdb.org/9130

Event History

Dec 31, 2004

CVE Published

05:00 AM

Aug 18, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What are the risks associated with CVE-2004-2427?

CVE-2004-2427 allows unauthorized remote access to sensitive information on affected Axis Network Cameras and Video Servers, posing a significant data security risk.

How can I prevent exploitation of CVE-2004-2427?

To prevent exploitation of CVE-2004-2427, ensure that your Axis Network Camera or Video Server firmware is updated to the latest version.

Which devices are affected by CVE-2004-2427?

CVE-2004-2427 affects various versions of the Axis 2100 and 2400 Network Cameras and Video Servers, specifically those running versions 2.40 and earlier or 3.12 and earlier.

What is the vulnerability type of CVE-2004-2427?

CVE-2004-2427 is classified as an information disclosure vulnerability.

What actions should I take if my device is affected by CVE-2004-2427?

If your device is affected by CVE-2004-2427, immediately update your firmware and review device access controls to restrict unauthorized access.