Axis Communications Network Cameras and Video Servers Authentication Bypass (CVE-2004-2426)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502705);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2004-2426");

  script_name(english:"Axis Communications Network Cameras and Video Servers Authentication Bypass (CVE-2004-2426)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Directory traversal vulnerability in Axis Network Camera 2.40 and
earlier, and Video Server 3.12 and earlier, allows remote attackers to
bypass authentication via a .. (dot dot) in an HTTP POST request to
ServerManager.srv, then use these privileges to conduct other
activities, such as modifying files using editcgi.cgi.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0948.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?11b154e8");
  # http://archives.neohapsis.com/archives/fulldisclosure/2004-08/1282.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a7f67a8b");
  script_set_attribute(attribute:"see_also", value:"http://secunia.com/advisories/12353");
  script_set_attribute(attribute:"see_also", value:"http://securitytracker.com/id?1011056");
# script_set_attribute(attribute:"see_also", value:"http://www.osvdb.org/9122");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/11011");
  script_set_attribute(attribute:"see_also", value:"https://exchange.xforce.ibmcloud.com/vulnerabilities/17079");
  # http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0948.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?11b154e8");
  # http://archives.neohapsis.com/archives/fulldisclosure/2004-08/1282.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a7f67a8b");
  script_set_attribute(attribute:"see_also", value:"http://secunia.com/advisories/12353");
  script_set_attribute(attribute:"see_also", value:"http://securitytracker.com/id?1011056");
# script_set_attribute(attribute:"see_also", value:"http://www.osvdb.org/9122");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/11011");
  script_set_attribute(attribute:"see_also", value:"https://exchange.xforce.ibmcloud.com/vulnerabilities/17079");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2004-2426");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2004/12/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2004/12/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:axis:230_mpeg2_video_server:3.11");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/AxisCommunication");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/AxisCommunication');

var asset = tenable_ot::assets::get(vendor:'AxisCommunication');

var vuln_cpes = {
    "cpe:/h:axis:230_mpeg2_video_server:3.11" :
        {"versionEndIncluding" : "3.11", "versionStartIncluding" : "3.11", "family" : "AxisCommunication"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);