漏洞标题
VAPIX API tcptext.cgi的输入验证不足。
漏洞描述信息
Brandon Rothel from QED Secure Solutions发现VAPIX API tcptest.cgi无法进行充分的输入验证，可能导致远程代码执行。只有在使用操作员或管理员权限的服务帐户进行身份验证后才可以利用此漏洞。受影响的漏洞利用对于拥有操作员权限的服务帐户而言，其影响较小。Axis已经针对该漏洞发布了AXIS OS修正版本。请参考Axis安全公告以获取更多信息和解决方法。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
漏洞类别
输入验证不恰当
漏洞标题
Insufficient input validation in VAPIX API tcptext.cgi
漏洞描述信息
Brandon
Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Axis has released patched AXIS OS
versions for the highlighted flaw. Please refer to the Axis security advisory
for more information and solution.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
漏洞类别
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
漏洞标题
AXIS M3024 代码注入漏洞
漏洞描述信息
AXIS M7014是一个视频解码器。AXIS M3024是一款网络摄像头。 Axis M3024-L M3025-VE M7014等存在安全漏洞，该漏洞源于VAPIX API tcptest.cgi没有足够的输入验证，允许远程代码执行。
CVSS信息
N/A
漏洞类别
代码注入