Vulnerability 11442 - CERT Civis.Net

Vulnerability Name:

CCN-11442

Published:

2003-02-28

Updated:

2003-02-28

Summary:

Multiple Axis Communications network video camera and video server devices are vulnerable to a buffer overflow in the embedded Web server. A vulnerability in the built-in Web server in the could allow a remote attacker to create arbitrary files and directories on the system. A remote attacker could send a specially-crafted URL request to the command.cgi script containing relative path sequences in the "buffername" and "format" parameters, which could allow the attacker to create arbitrary directories and files on the system.

CVSS v3 Severity:

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): Partial