Summaryinfo

A vulnerability categorized as critical has been discovered in AXIS M1033-W 5.40.5.1. This affects an unknown function of the file fileUpload.shtml of the component mod_include. Such manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2018-9157. The attack may be performed from remote. There is no available exploit. The actual existence of this vulnerability is currently in question. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability, which was classified as critical, has been found in AXIS M1033-W 5.40.5.1. Affected by this issue is an unknown functionality of the file fileUpload.shtml of the component mod_include. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

** DISPUTED ** An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.

The weakness was presented 04/01/2018 (Website). The advisory is shared for download at slideshare.net. This vulnerability is handled as CVE-2018-9157 since 03/31/2018. The attack may be launched remotely. The successful exploitation needs a simple authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-115509 for similar entry. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• AXIS

Name

• M1033-W

Version

• 5.40.5.1

License

• free

Website

• Vendor: https://www.axis.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion