CVE-2015-8257

The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml.

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

17.69% chance of exploitation in the next 30 days, 97th percentile

Published

2017-05-02

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/138083/AXIS-Authenticated-Remote-Command-Execution.h…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40171

References

• CVE Record
• NVD entry

Related

• CVE-2015-8256
• CVE-2015-8258
• CVE-2015-8255
• CVE-2015-8261
• CVE-2015-8249
• CVE-2015-8270