IP Surveillance Bugs in Axis Gear Allow RCE, Data Theft
Security researchers have uncovered three vulnerabilities located in Axis video products that could allow for multiple different cyberattacks, including arbitrary code execution. Nozomi Networks Labs have been investigating the flaws, which are located in the Axis Companion Recorder. This tool serves as a compact network video recorder that stores IP surveillance video coming from attached cameras. The companion recorder can support up to eight cameras at a time.
The three bugs affect all Axis devices that run the company’s embedded Axis OS, therefore, a large number of devices are impacted. The first bug is a heap-based buffer overflow flaw and has been given a CVSS rating of 6.7. The second pertains to improper recipient validation in network test functionalities and has a lower CVSS score of 4.1, whereas the last is an SMTP header injection in email test vulnerability and has a score of 5.5. All attacks would require that the victim visit a specially crafted webpage or click on a malicious link.