CVE-2004-2426

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication via a .. (dot dot) in an HTTP POST request to ServerManager.srv, then use these privileges to conduct other activities, such as modifying files using editcgi.cgi.

Affected products

Axis 2100 Network Camera: 2.12, 2.30, 2.31, 2.32, 2.33, 2.34 (+2)
Axis 2110 Network Camera: 2.12, 2.30, 2.31, 2.32, 2.34, 2.40 (+1)
Axis 2120 Network Camera: 2.12, 2.30, 2.31, 2.32, 2.34, 2.40 (+1)
Axis 2130 Ptz Network Camera: 2.30, 2.31, 2.32, 2.34, 2.40
Axis 230 Mpeg2 Video Server: 3.11
Axis 2400 Video Server: 1.1, 1.2, 1.10, 1.11, 1.12, 1.15 (+9)
Axis 2401 Video Server: 1.0_1, 1.15, 2.20, 2.30, 2.31, 2.32 (+4)
Axis 2411 Video Server: 3.12, 3.13
Axis 2420 Network Camera: 2.12, 2.30, 2.31, 2.32, 2.33, 2.34 (+2)
Axis 2420 Video Server: 2.32, 2.34
Axis 2460 Network Dvr: 3.10, 3.11
Axis 2490 Serial Server: 2.11.3
Axis 250S Video Server: 3.03, 3.10
Axis Storpoint Cd: all versions

References

Get alerted when CVE-2004-2426 or the next vulnerability affects your stack