CVE-2018-10662

published 2018-06-26

CVE-2018-10662: An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.

Priority P2 78 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT

An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.

Affected

390 ranges · showing 25

Vendor	Product	Version range	Fixed in
axis	a1001_firmware	< 1.65.1	1.65.1
axis	a8004-v_firmware	< 1.65.2	1.65.2
axis	a8105-e_firmware	< 1.65.2	1.65.2
axis	a9161_firmware	< 1.65.0	1.65.0
axis	a9188-v_firmware	< 1.65.0	1.65.0
axis	a9188_firmware	< 1.65.0	1.65.0
axis	c1004-e_firmware	< 1.81.040.1	1.81.040.1
axis	c2005_firmware	< 1.81.040.1	1.81.040.1
axis	c3003-e_firmware	< 1.81.040.1	1.81.040.1
axis	c8033_firmware	< 1.81.040.1	1.81.040.1
axis	companion_bullet_le_firmware	< 8.20.1	8.20.1
axis	companion_c360_firmware	< 7.15.2.3	7.15.2.3
axis	companion_cube_l_firmware	< 8.20.1	8.20.1
axis	companion_cube_lw_firmware	< 8.20.1	8.20.1
axis	companion_dome_v_firmware	< 8.20.1	8.20.1
axis	companion_dome_wv_firmware	< 8.20.1	8.20.1
axis	companion_eye_l_firmware	< 8.20.1	8.20.1
axis	companion_eye_lve_firmware	< 8.20.1	8.20.1
axis	companion_recorder_4ch_firmware	< 1.20.1	1.20.1
axis	companion_recorder_8ch_firmware	< 1.20.1	1.20.1
axis	d201-s_xpt_q6055_firmware	< 6.50.2.3	6.50.2.3
axis	d2050-ve_firmware	< 7.35.4.2	7.35.4.2
axis	f34_main_unit_firmware	< 6.50.2.3	6.50.2.3
axis	f41_main_unit_firmware	< 6.50.2.3	6.50.2.3
axis	f44_dual_audio_input_firmware	< 6.50.2.3	6.50.2.3

Detection & IOCs extracted from sources · hover to see the quote

url /index.html/<random>.srv↗

command dbus-send --system --dest=com.axis.PolicyKitParhand --type=method_call /com/axis/PolicyKitParhand com.axis.PolicyKitParhand.SetParameter↗

command com.axis.PolicyKitParhand.SynchParameters↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Axis Communications Security Camera Command Injection Attempt (CVE-2018-10660, CVE-2018-10661, CVE-2018-10662) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".srv"; endswith; http.request_body; content:"com.axis.PolicyKitParhand"; fast_pattern; content:"string:"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,www.vdoo.com/blog/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; reference:cve,2018-10660; reference:cve,2018-10661; reference:cve,2018-10662; reference:url,www.exploit-db.com/exploits/45100; classtype:attempted-admin; sid:2059464; rev:1; metadata:affected_product Axis_Communications, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_01_22, cve CVE_2018_10660_CVE_2018_10661_CVE_2018_10662, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_01_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit sends HTTP POST requests to a URI ending in a random alphanumeric string with a '.srv' extension (e.g., /index.html/<8-42 random chars>.srv). Detect POST requests where the URI ends with '.srv'. ↗
• → POST body contains 'com.axis.PolicyKitParhand' combined with 'string:' followed by shell metacharacters (semicolon ';', newline '\x0a', backtick '`', pipe '|', dollar sign '$') indicating command injection payload.
• → The exploit injects a command into the 'root.Time.DST.Enabled' parameter value, wrapped in semicolons (e.g., 'string:root.Time.DST.Enabled string:;<cmd>;'). Look for this parameter name in POST bodies to Axis camera endpoints. ↗
• → The exploit uses the 'cmd/unix/reverse_netcat_gaping' payload by default, requiring netcat with -e support. Monitor for outbound netcat reverse shell connections from Axis camera IP addresses. ↗
• → Two sequential POST requests are sent to the same .srv URI: first to SetParameter (injecting the command), then to SynchParameters (triggering execution). Correlate pairs of POST requests to the same .srv URI from the same source. ↗

• · The Metasploit module only implements the 'Unix In-Memory' target (ARCH_CMD); the 'Linux Dropper' (ARCH_ARMLE) target is commented out and not functional in the published module. ↗
• · The payload encoder 'cmd/ifs' is required and bad characters include spaces; payloads must avoid spaces and use IFS substitution. Detection rules should account for space-encoded variants. ↗
• · The Snort/ET rule only covers plaintext (non-TLS) traffic. Encrypted HTTPS traffic to Axis cameras would not be detected by this signature.

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.