Vulnerability Description
An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Axis | M1033-W Firmware | 5.40.5.1 |
| Axis | M1033-W | - |
Related Weaknesses (CWE)
References
- https://www.slideshare.net/secret/pRWQOOe6rN8IybThird Party Advisory
- https://www.slideshare.net/secret/pRWQOOe6rN8IybThird Party Advisory
FAQ
What is CVE-2018-9157?
CVE-2018-9157 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.sh...
How severe is CVE-2018-9157?
CVE-2018-9157 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-9157?
Check the references section above for vendor advisories and patch information. Affected products include: Axis M1033-W Firmware, Axis M1033-W.