CVE-2004-2425

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi.

Affected products

Axis 2100 Network Camera: 2.12, 2.30, 2.31, 2.32, 2.33, 2.34 (+2)
Axis 2110 Network Camera: 2.12, 2.30, 2.31, 2.32, 2.34, 2.40 (+1)
Axis 2120 Network Camera: 2.12, 2.30, 2.31, 2.32, 2.34, 2.40 (+1)
Axis 2130 Ptz Network Camera: 2.30, 2.31, 2.32, 2.34, 2.40
Axis 230 Mpeg2 Video Server: 3.11
Axis 2400 Video Server: 1.1, 1.2, 1.10, 1.11, 1.12, 1.15 (+9)
Axis 2401 Video Server: 1.0_1, 1.15, 2.20, 2.30, 2.31, 2.32 (+4)
Axis 2411 Video Server: 3.12, 3.13
Axis 2420 Network Camera: 2.12, 2.30, 2.31, 2.32, 2.33, 2.34 (+2)
Axis 2420 Video Server: 2.32, 2.34
Axis 2460 Network Dvr: 3.10, 3.11
Axis 2490 Serial Server: 2.11.3
Axis 250S Video Server: 3.03, 3.10
Axis Storpoint Cd: all versions

References

Get alerted when CVE-2004-2425 or the next vulnerability affects your stack