CVE-2018-10660
published 2018-06-26CVE-2018-10660: An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
PriorityP183critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
82.15%
99.6th percentile
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
Affected
390 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| axis | a1001_firmware | < 1.65.1 | 1.65.1 |
| axis | a8004-v_firmware | < 1.65.2 | 1.65.2 |
| axis | a8105-e_firmware | < 1.65.2 | 1.65.2 |
| axis | a9161_firmware | < 1.65.0 | 1.65.0 |
| axis | a9188-v_firmware | < 1.65.0 | 1.65.0 |
| axis | a9188_firmware | < 1.65.0 | 1.65.0 |
| axis | c1004-e_firmware | < 1.81.040.1 | 1.81.040.1 |
| axis | c2005_firmware | < 1.81.040.1 | 1.81.040.1 |
| axis | c3003-e_firmware | < 1.81.040.1 | 1.81.040.1 |
| axis | c8033_firmware | < 1.81.040.1 | 1.81.040.1 |
| axis | companion_bullet_le_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_c360_firmware | < 7.15.2.3 | 7.15.2.3 |
| axis | companion_cube_l_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_cube_lw_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_dome_v_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_dome_wv_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_eye_l_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_eye_lve_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_recorder_4ch_firmware | < 1.20.1 | 1.20.1 |
| axis | companion_recorder_8ch_firmware | < 1.20.1 | 1.20.1 |
| axis | d201-s_xpt_q6055_firmware | < 6.50.2.3 | 6.50.2.3 |
| axis | d2050-ve_firmware | < 7.35.4.2 | 7.35.4.2 |
| axis | f34_main_unit_firmware | < 6.50.2.3 | 6.50.2.3 |
| axis | f41_main_unit_firmware | < 6.50.2.3 | 6.50.2.3 |
| axis | f44_dual_audio_input_firmware | < 6.50.2.3 | 6.50.2.3 |
Detection & IOCsextracted from sources · hover to see the quote
path/axis-cgi/
path.srv
othercom.axis.PolicyKitParhand
command--system --dest=com.axis.PolicyKitParhand --type=method_call /com/axis/PolicyKitParhand com.axis.PolicyKitParhand.SetParameter↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660) M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/axis-cgi/"; fast_pattern; startswith; content:".cgi|3f|"; distance:0; pcre:"/^.+(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,www.vdoo.com/blog/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; reference:cve,2018-10660; classtype:attempted-admin; sid:2059463; rev:1;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".srv"; endswith; http.request_body; content:"com.axis.PolicyKitParhand"; fast_pattern; content:"string:"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:cve,2018-10660; classtype:attempted-admin; sid:2059464; rev:1;)
- →Exploit uses HTTP POST to a URI ending in a random alphanumeric string with a .srv extension (e.g., /index.html/<8-42 char random>.srv) — detect POST requests with URIs ending in .srv ↗
- →Injection payload is embedded in the 'args' POST body field targeting the D-Bus parameter 'string:root.Time.DST.Enabled' with shell metacharacters (;, newline, backtick, pipe, $) appended after the value ↗
- →M1 rule: detect GET requests to /axis-cgi/*.cgi? URIs containing shell injection characters (;, %3B, newline %0A, backtick %60, pipe %7C, dollar %24) in the URI
- →M2 rule: detect POST requests to URIs ending in .srv with request body containing 'com.axis.PolicyKitParhand' and 'string:' followed by shell injection metacharacters
- →Exploit chains two POST requests: first to set a parameter with injected command via SetParameter, then a second to trigger execution via SynchParameters — look for sequential .srv POSTs from the same source ↗
- →Default Metasploit payload used is cmd/unix/reverse_netcat_gaping — monitor for outbound netcat reverse shell connections from camera devices ↗
- ·The exploit requires no authentication due to an auth bypass in the .srv functionality chained with the command injection in parhand — authentication controls alone are insufficient to block this attack ↗
- ·The Metasploit module's BadChars for the payload include spaces, and the encoder 'cmd/ifs' is used to bypass this — detection rules should account for IFS-encoded payloads in addition to plain shell metacharacters ↗
- ·Snort/Suricata rules are scoped to plaintext HTTP (tls_state plaintext) — encrypted HTTPS traffic to cameras will not be detected by these signatures
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660) M1
suricata·2025-01-22·CVSS 9.8
CVE-2018-10660 [CRITICAL] ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660) M1
ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660) M1
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660) M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/axis-cgi/"; fast_pattern; startswith; content:".cgi|3f|"; distance:0; pcre:"/^.+(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,www.vdoo.com/blog/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; reference:cve,2018-10660; classtype:attempted-admin; sid:2059463; rev:1; metadata:affected_product Axis_Communications, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_01_22, cve CVE_201
Suricata
ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2
suricata·2025-01-22·CVSS 9.8
CVE-2018-10660 [CRITICAL] ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2
ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".srv"; endswith; http.request_body; content:"com.axis.PolicyKitParhand"; fast_pattern; content:"string:"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,www.vdoo.com/blog/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; reference:cve,2018-10660; reference:cve,2018-10661; reference:cve,2018-10662; reference:url,
Exploit-DB
Axis Network Camera - .srv to parhand Remote Code Execution (Metasploit)
exploitdb·2018-07-27
CVE-2018-10662 Axis Network Camera - .srv to parhand Remote Code Execution (Metasploit)
Axis Network Camera - .srv to parhand Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Axis Network Camera .srv to parhand RCE',
'Description' => %q{
This module exploits an auth bypass in .srv functionality and a
command injection in parhand to execute code as the root user.
},
'Author' => [
'Or Peles', # Vulnerability discovery (VDOO)
'wvu', # Metasploit module
'sinn3r', # Metasploit module
'Brent Cook', # Metasploit module
'Jacob Robles', # Metasploit module
'Matthew Kienow', # Metasploit module
'Shelby Pace', # Metasploit module
'Chris Lee', # Metasploit module
'Cale Black' # Metasploit module
],
'References' => [
['CVE', '2018-10660
Metasploit
Axis Network Camera .srv-to-parhand RCE
metasploit
Axis Network Camera .srv-to-parhand RCE
Axis Network Camera .srv-to-parhand RCE
This module exploits an auth bypass in .srv functionality and a command injection in parhand to execute code as the root user.
https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/https://www.axis.com/files/faq/Advisory_ACV-128401.pdfhttps://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdfhttps://www.exploit-db.com/exploits/45100/https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/https://www.axis.com/files/faq/Advisory_ACV-128401.pdfhttps://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdfhttps://www.exploit-db.com/exploits/45100/
2018-06-26
Published