CVE-2018-10661
published 2018-06-26CVE-2018-10661: An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
PriorityP189critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
86.68%
99.7th percentile
An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
Affected
390 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| axis | a1001_firmware | < 1.65.1 | 1.65.1 |
| axis | a8004-v_firmware | < 1.65.2 | 1.65.2 |
| axis | a8105-e_firmware | < 1.65.2 | 1.65.2 |
| axis | a9161_firmware | < 1.65.0 | 1.65.0 |
| axis | a9188-v_firmware | < 1.65.0 | 1.65.0 |
| axis | a9188_firmware | < 1.65.0 | 1.65.0 |
| axis | c1004-e_firmware | < 1.81.040.1 | 1.81.040.1 |
| axis | c2005_firmware | < 1.81.040.1 | 1.81.040.1 |
| axis | c3003-e_firmware | < 1.81.040.1 | 1.81.040.1 |
| axis | c8033_firmware | < 1.81.040.1 | 1.81.040.1 |
| axis | companion_bullet_le_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_c360_firmware | < 7.15.2.3 | 7.15.2.3 |
| axis | companion_cube_l_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_cube_lw_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_dome_v_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_dome_wv_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_eye_l_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_eye_lve_firmware | < 8.20.1 | 8.20.1 |
| axis | companion_recorder_4ch_firmware | < 1.20.1 | 1.20.1 |
| axis | companion_recorder_8ch_firmware | < 1.20.1 | 1.20.1 |
| axis | d201-s_xpt_q6055_firmware | < 6.50.2.3 | 6.50.2.3 |
| axis | d2050-ve_firmware | < 7.35.4.2 | 7.35.4.2 |
| axis | f34_main_unit_firmware | < 6.50.2.3 | 6.50.2.3 |
| axis | f41_main_unit_firmware | < 6.50.2.3 | 6.50.2.3 |
| axis | f44_dual_audio_input_firmware | < 6.50.2.3 | 6.50.2.3 |
Detection & IOCsextracted from sources · hover to see the quote
path*.srv
commanddbus-send --system --dest=com.axis.PolicyKitParhand --type=method_call /com/axis/PolicyKitParhand com.axis.PolicyKitParhand.SetParameter↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".srv"; endswith; http.request_body; content:"com.axis.PolicyKitParhand"; fast_pattern; content:"string:"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,www.vdoo.com/blog/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; reference:cve,2018-10660; reference:cve,2018-10661; reference:cve,2018-10662; reference:url,www.exploit-db.com/exploits/45100; classtype:attempted-admin; sid:2059464; rev:1; metadata:affected_product Axis_Communications, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_01_22, cve CVE_2018_10660_CVE_2018_10661_CVE_2018_10662, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_01_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Exploit sends HTTP POST to a URI ending in a random alphanumeric string with a .srv extension (e.g., /index.html/<8-42 random chars>.srv) — detect POST requests whose URI ends with .srv ↗
- →POST body contains 'com.axis.PolicyKitParhand' as the D-Bus destination, combined with 'string:' followed by shell metacharacters (;, newline, backtick, pipe, $) indicating command injection payload
- →The exploit chains two POST requests: first SetParameter with an injected command in the DST.Enabled string parameter, then SynchParameters to trigger execution — look for two sequential POSTs to .srv URIs from the same source ↗
- →The injected command is embedded in the parameter string 'root.Time.DST.Enabled' with semicolons as shell delimiters — inspect parhand parameter values for shell metacharacters ↗
- →Default Metasploit payload used is cmd/unix/reverse_netcat_gaping — monitor for outbound netcat reverse shell connections from camera devices ↗
- ·The .srv URI path component is randomized (8–42 alphanumeric characters) per exploit invocation, so exact URI matching will not work — detection must rely on the .srv suffix pattern rather than a fixed path ↗
- ·The Snort/ET rule is marked tls_state plaintext, meaning it will not detect exploitation over HTTPS/TLS-encrypted connections
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5p6f-grw5-jp3r: An issue was discovered in multiple models of Axis IP Cameras
ghsa_unreviewed·2022-05-13
CVE-2018-10661 [CRITICAL] GHSA-5p6f-grw5-jp3r: An issue was discovered in multiple models of Axis IP Cameras
An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
VulnCheck
Axis IP Cameras Authorization Bypass Vulnerability
vulncheck·2018·CVSS 9.8
CVE-2018-10661 [CRITICAL] Axis IP Cameras Authorization Bypass Vulnerability
Axis IP Cameras Authorization Bypass Vulnerability
An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
Affected: axis a1001_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.f5.com/labs/articles/shellshock-makes-a-comeback-and-rondodox-changes-tactics
Exploit PoC: https://vulncheck.com/xdb/2cbef7962e38
Suricata
ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2
suricata·2025-01-22·CVSS 9.8
CVE-2018-10660 [CRITICAL] ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2
ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".srv"; endswith; http.request_body; content:"com.axis.PolicyKitParhand"; fast_pattern; content:"string:"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,www.vdoo.com/blog/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; reference:cve,2018-10660; reference:cve,2018-10661; reference:cve,2018-10662; reference:url,
Exploit-DB
Axis Network Camera - .srv to parhand Remote Code Execution (Metasploit)
exploitdb·2018-07-27
CVE-2018-10662 Axis Network Camera - .srv to parhand Remote Code Execution (Metasploit)
Axis Network Camera - .srv to parhand Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Axis Network Camera .srv to parhand RCE',
'Description' => %q{
This module exploits an auth bypass in .srv functionality and a
command injection in parhand to execute code as the root user.
},
'Author' => [
'Or Peles', # Vulnerability discovery (VDOO)
'wvu', # Metasploit module
'sinn3r', # Metasploit module
'Brent Cook', # Metasploit module
'Jacob Robles', # Metasploit module
'Matthew Kienow', # Metasploit module
'Shelby Pace', # Metasploit module
'Chris Lee', # Metasploit module
'Cale Black' # Metasploit module
],
'References' => [
['CVE', '2018-10660
Metasploit
Axis Network Camera .srv-to-parhand RCE
metasploit
Axis Network Camera .srv-to-parhand RCE
Axis Network Camera .srv-to-parhand RCE
This module exploits an auth bypass in .srv functionality and a command injection in parhand to execute code as the root user.
https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/https://www.axis.com/files/faq/Advisory_ACV-128401.pdfhttps://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdfhttps://www.exploit-db.com/exploits/45100/https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/https://www.axis.com/files/faq/Advisory_ACV-128401.pdfhttps://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdfhttps://www.exploit-db.com/exploits/45100/
2018-06-26
Published
Exploited in the wild